The vulnerability identified as CVE-2025-14978 affects the PeachPay — Payments & Express Checkout plugin for WooCommerce, which integrates multiple payment gateways including Stripe, PayPal, Square, and Authorize.net. The root cause is a missing authorization check (CWE-862) on the ConvesioPay webhook REST endpoint, allowing unauthenticated attackers to send crafted requests that modify the status of arbitrary WooCommerce orders. This flaw exists in all versions up to and including 1.119.8. Because the endpoint lacks capability checks, attackers can bypass authentication and authorization mechanisms, directly impacting order integrity. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), reflecting its network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no direct confidentiality or availability consequences. No public exploits have been reported yet, but the potential for fraudulent order manipulation or disruption of business processes is significant. The vulnerability was published on January 20, 2026, and no patches are currently linked, indicating that users must implement interim mitigations. The affected plugin is widely used in e-commerce environments, making this a relevant threat to online retailers relying on WooCommerce and PeachPay for payment processing.

For European organizations, this vulnerability poses a risk to the integrity of e-commerce transactions processed via WooCommerce sites using the PeachPay plugin. Attackers could manipulate order statuses, potentially causing financial discrepancies, fulfillment errors, or fraudulent order processing. This could lead to financial losses, reputational damage, and customer trust erosion. Since payment gateways like Stripe, PayPal, Square, and Authorize.net are involved, unauthorized order status changes might also complicate payment reconciliation and dispute resolution. The impact is particularly critical for businesses with high transaction volumes or those operating in regulated sectors requiring strict transaction integrity. Additionally, attackers could exploit this flaw to disrupt supply chains or inventory management by triggering false order completions or cancellations. Although no confidentiality breach occurs, the integrity compromise can indirectly affect compliance with data protection and financial regulations. The lack of authentication requirement increases the attack surface, making it easier for remote attackers to exploit without insider access or user interaction.

1. Immediately restrict access to the ConvesioPay webhook REST endpoint by implementing IP whitelisting to allow only trusted payment gateway IP addresses. 2. Deploy web application firewall (WAF) rules to detect and block unauthorized requests targeting the webhook endpoint. 3. Monitor WooCommerce order status changes closely for unusual patterns or spikes that could indicate exploitation attempts. 4. Implement additional server-side validation to verify the authenticity of webhook requests, such as validating signatures or tokens provided by payment gateways. 5. Disable or temporarily deactivate the PeachPay plugin if feasible until an official patch is released. 6. Engage with the plugin vendor or community to obtain updates or patches as soon as they become available. 7. Educate e-commerce and IT teams about this vulnerability to increase awareness and readiness to respond to suspicious activity. 8. Review and enhance logging around order management and webhook interactions to support forensic investigations if exploitation occurs.