CVE-2025-14078 – The PAYGENT for WooCommerce WordPress plugin ha... (How to Fix)

Q: What is the severity of CVE-2025-14078?

CVE-2025-14078 has a CVSS score of 5.3 (MEDIUM). The PAYGENT for WooCommerce WordPress plugin has an authorization bypass vulnerability that allows unauthenticated attackers to send forged payment notifications. This can manipulate payment callbacks and modify order statuses, potentially marking unpaid orders as paid. All WordPress sites using this plugin up to version 2.4.6 are affected.

📋 TL;DR

The PAYGENT for WooCommerce WordPress plugin has an authorization bypass vulnerability that allows unauthenticated attackers to send forged payment notifications. This can manipulate payment callbacks and modify order statuses, potentially marking unpaid orders as paid. All WordPress sites using this plugin up to version 2.4.6 are affected.

💻 Affected Systems

Products:

PAYGENT for WooCommerce WordPress plugin

Versions: All versions up to and including 2.4.6

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with the PAYGENT plugin active and WooCommerce configured for Paygent payments.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could mark fraudulent orders as paid, causing financial loss through shipping goods without payment, or manipulate legitimate orders to disrupt business operations.

🟠

Likely Case

Attackers exploit payment systems to receive goods/services without paying by forging successful payment notifications for their own orders.

🟢

If Mitigated

With proper web application firewalls and monitoring, unauthorized API calls would be blocked or detected before causing damage.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted POST requests to the vulnerable endpoint, which is straightforward for attackers with basic web skills.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.7 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3433179%40woocommerce-for-paygent-payment-main&new=3433179%40woocommerce-for-paygent-payment-main&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find PAYGENT for WooCommerce. 4. Click 'Update Now' if available, or download version 2.4.7+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Block vulnerable endpoint via .htaccess

linux

Temporarily block access to the vulnerable REST API endpoint

# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteRule ^wp-json/paygent/v1/check/ - [F,L]

Disable plugin

linux

Temporarily disable the PAYGENT plugin until patched

wp plugin deactivate woocommerce-for-paygent-payment-main

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block requests to /wp-json/paygent/v1/check/ endpoint
Monitor and alert on unauthorized access attempts to the Paygent API endpoint

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. If PAYGENT for WooCommerce is version 2.4.6 or lower, you are vulnerable.

Check Version:

wp plugin get woocommerce-for-paygent-payment-main --field=version

Verify Fix Applied:

After updating, verify plugin version shows 2.4.7 or higher. Test payment notifications work correctly for legitimate transactions.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-json/paygent/v1/check/ from unexpected IPs
Order status changes from 'pending' to 'processing' or 'completed' without corresponding payment records

Network Indicators:

HTTP POST requests to /wp-json/paygent/v1/check/ without proper authentication headers
Unusual traffic patterns to WooCommerce REST API endpoints

SIEM Query:

source="web_server_logs" AND uri_path="/wp-json/paygent/v1/check/" AND http_method="POST" AND NOT user_agent="Paygent-Webhook"

📊 Metadata

CVE ID: CVE-2025-14078

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-862

EPSS Score: 0.07% exploit probability (22th percentile)

Published: January 17, 2026

Last Updated: January 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-14078, you might also want to check these: