CVE-2025-14978 identifies a missing authorization vulnerability (CWE-862) in the PeachPay — Payments & Express Checkout plugin for WooCommerce, which supports multiple payment gateways including Stripe, PayPal, Square, and Authorize.net. The vulnerability exists in the ConvesioPay webhook REST endpoint, where capability checks are absent, allowing unauthenticated attackers to send crafted requests that modify the status of arbitrary WooCommerce orders. This flaw affects all plugin versions up to and including 1.119.8. The vulnerability does not expose confidential data nor does it affect system availability, but it compromises the integrity of order data by enabling unauthorized status changes. The CVSS 3.1 base score is 5.3 (medium), reflecting the ease of remote exploitation without authentication or user interaction, but limited impact scope. No public exploits have been reported yet. The vulnerability could be exploited to fraudulently mark orders as paid, canceled, or completed, potentially disrupting financial reconciliation and customer trust. The root cause is the lack of proper capability checks on the webhook endpoint, which should validate the authenticity and authorization of incoming requests before processing order status changes. Since the plugin integrates with major payment gateways, the impact could extend to payment processing workflows. The vulnerability is particularly relevant for WooCommerce stores using PeachPay in Europe, where WooCommerce is widely adopted. Mitigation currently relies on vendor patches once released, but interim measures include restricting webhook endpoint access via IP whitelisting or firewall rules and implementing additional authorization logic at the application level.

For European organizations, especially e-commerce businesses relying on WooCommerce with the PeachPay plugin, this vulnerability poses a risk to order integrity. Attackers could manipulate order statuses without authentication, potentially marking unpaid orders as paid or canceling legitimate orders, leading to financial losses, inventory mismanagement, and customer dissatisfaction. This could also undermine trust in online payment processes and damage brand reputation. The impact is more pronounced for mid to large-scale online retailers with high transaction volumes. While confidentiality and availability are not directly affected, the integrity compromise can indirectly affect business operations and compliance with financial regulations. Organizations processing payments through Stripe, PayPal, Square, or Authorize.net via PeachPay are particularly exposed. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, as attackers may develop exploits once details become widely known. The vulnerability could also be leveraged as part of larger fraud schemes or social engineering attacks targeting customers or support teams.

1. Monitor the PeachPay plugin vendor announcements and apply security patches immediately once available to address the missing authorization checks. 2. Until patches are released, restrict access to the ConvesioPay webhook REST endpoint by implementing IP whitelisting to allow only trusted payment gateway IP addresses. 3. Employ web application firewall (WAF) rules to detect and block suspicious requests targeting the webhook endpoint. 4. Implement custom authorization logic within the WooCommerce environment to validate incoming webhook requests, such as verifying HMAC signatures or shared secrets. 5. Regularly audit WooCommerce order statuses and logs for unauthorized or suspicious changes to detect potential exploitation early. 6. Educate support and operations teams about this vulnerability to recognize and respond to anomalies in order processing. 7. Consider isolating the webhook endpoint on a separate subdomain or server with stricter access controls. 8. Review and harden overall WordPress and WooCommerce security posture, including least privilege principles for plugins and users. 9. Backup order and transaction data frequently to enable recovery from potential manipulation. 10. Engage with payment gateway providers to ensure webhook security best practices are followed.