CVE-2025-14460
📋 TL;DR
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress has an authorization bypass vulnerability that allows unauthenticated attackers to change any order status to 'failed' by exploiting a publicly accessible API endpoint. This affects all WordPress sites using this plugin up to version 3.1.4. Attackers can easily enumerate sequential order IDs to disrupt business operations.
💻 Affected Systems
- Piraeus Bank WooCommerce Payment Gateway plugin for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Mass order status manipulation causing widespread shipment cancellations, inventory system corruption, significant revenue loss, and potential customer data exposure through order enumeration.
Likely Case
Targeted attacks changing order statuses to 'failed' causing shipment delays, customer service issues, and moderate revenue impact.
If Mitigated
Limited impact with proper network controls and monitoring, but still potential for minor business disruption.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint with sequential order IDs. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.5 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/woo-payment-gateway-for-piraeus-bank
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Piraeus Bank WooCommerce Payment Gateway'. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 3.1.5+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Block vulnerable endpoint via .htaccess
linuxRestrict access to the payment callback endpoint
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wc-api/piraeusbank_gateway
RewriteRule ^ - [F,L]
</IfModule>
Web Application Firewall rule
allBlock requests to the vulnerable endpoint pattern
WAF rule to block: URI contains '/wc-api/piraeusbank_gateway' AND contains 'MerchantReference' parameter
🧯 If You Can't Patch
- Disable the Piraeus Bank payment gateway plugin immediately and use alternative payment methods.
- Implement rate limiting and monitoring on /wc-api/piraeusbank_gateway endpoint to detect exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Piraeus Bank WooCommerce Payment Gateway'. If version is 3.1.4 or lower, you are vulnerable.Check Version:
wp plugin list --name='woo-payment-gateway-for-piraeus-bank' --field=versionVerify Fix Applied:
After updating, verify plugin version shows 3.1.5 or higher. Test that order status cannot be changed via unauthenticated requests to /wc-api/piraeusbank_gateway.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wc-api/piraeusbank_gateway with different MerchantReference parameters
- Unusual spike in order status changes to 'failed'
- Requests from unusual IP addresses to payment callback endpoint
Network Indicators:
- HTTP POST requests to /wc-api/piraeusbank_gateway endpoint without authentication
- Sequential order ID patterns in requests
SIEM Query:
source="web_logs" AND uri="/wc-api/piraeusbank_gateway" AND status=200 | stats count by src_ip🔗 References
- https://plugins.trac.wordpress.org/browser/woo-payment-gateway-for-piraeus-bank/tags/3.1.4/classes/WC_Piraeusbank_Gateway.php#L821
- https://plugins.trac.wordpress.org/browser/woo-payment-gateway-for-piraeus-bank/trunk/classes/WC_Piraeusbank_Gateway.php#L821
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b15198-8f44-4390-862b-35d41eb8a854?source=cve
