PT-2026-2819 · WordPress · Netcash Woocommerce Payment Gateway

CVE-2025-14880

·

Publicado

2026-01-14

·

Atualizado

2026-01-14

CVSS v3.1

5.3

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Netcash WooCommerce Payment Gateway plugin for WordPress versions up to and including 4.1.3
Description The Netcash WooCommerce Payment Gateway plugin for WordPress has a flaw where a missing capability check on the handle return url function allows unauthorized modification of data. This enables unauthenticated attackers to change the status of any WooCommerce order to processing or completed.
Recommendations Update the Netcash WooCommerce Payment Gateway plugin to a version later than 4.1.3.

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14880

Produtos afetados

Netcash Woocommerce Payment Gateway