CVE-2025-14971
📋 TL;DR
This vulnerability in the Link Invoice Payment for WooCommerce WordPress plugin allows unauthenticated attackers to create or cancel partial payments on any WooCommerce order via ID enumeration. All WordPress sites using this plugin up to version 2.8.0 are affected. The issue stems from missing capability checks in two API functions.
💻 Affected Systems
- Link Invoice Payment for WooCommerce WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate payment statuses to disrupt business operations, create fraudulent payment records, or interfere with legitimate customer transactions, potentially causing financial and reputational damage.
Likely Case
Attackers will test for vulnerable sites and manipulate partial payments, potentially causing order fulfillment issues, customer confusion, and administrative overhead to clean up fraudulent records.
If Mitigated
With proper network segmentation and web application firewalls, the impact is limited to potential data integrity issues within the WooCommerce payment system.
🎯 Exploit Status
The vulnerability is straightforward to exploit via HTTP requests to the vulnerable endpoints without authentication. Attackers can enumerate order IDs to target specific orders.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.1 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Link Invoice Payment for WooCommerce'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.8.1+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable endpoints via .htaccess
linuxBlock access to the vulnerable API endpoints at the web server level
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/wc-payment-invoice/v1/(createPartialPayment|cancelPartialPayment) [NC]
RewriteRule ^ - [F]
Deactivate plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate invoice-payment-for-woocommerce
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with rules to block requests to /wp-json/wc-payment-invoice/v1/createPartialPayment and /wp-json/wc-payment-invoice/v1/cancelPartialPayment
- Restrict access to WordPress admin and API endpoints to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for 'Link Invoice Payment for WooCommerce' version 2.8.0 or earlierCheck Version:
wp plugin get invoice-payment-for-woocommerce --field=versionVerify Fix Applied:
Verify plugin version is 2.8.1 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to POST /wp-json/wc-payment-invoice/v1/createPartialPayment or /wp-json/wc-payment-invoice/v1/cancelPartialPayment from unauthenticated users
- Unusual patterns of partial payment creation/cancellation in WooCommerce logs
Network Indicators:
- POST requests to vulnerable endpoints without authentication headers
- Rapid sequential requests with different order ID parameters
SIEM Query:
source="web_access_logs" AND (uri_path="/wp-json/wc-payment-invoice/v1/createPartialPayment" OR uri_path="/wp-json/wc-payment-invoice/v1/cancelPartialPayment") AND http_status=200 AND NOT user_agent="*bot*"🔗 References
- https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L179
- https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L19
- https://www.wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=cve
