PT-2026-3531 · WordPress · Peachpay — Payments & Express Checkout For Woocommerce
CVE-2025-14978
·
Publicado
2026-01-20
·
Atualizado
2026-01-20
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
PeachPay — Payments & Express Checkout for WooCommerce versions through 1.119.8
Description
The PeachPay — Payments & Express Checkout for WooCommerce plugin for WordPress has a flaw that allows unauthorized modification of data. Specifically, a missing capability check on the ConvesioPay webhook REST endpoint allows unauthenticated attackers to modify the status of arbitrary WooCommerce orders.
Recommendations
Update PeachPay — Payments & Express Checkout for WooCommerce to a version later than 1.119.8.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Peachpay — Payments & Express Checkout For Woocommerce