CVE-2025-14843

Name of the Vulnerable Software and Affected Versions Wizit Gateway for WooCommerce versions prior to 1.3.2

Description The plugin is subject to unauthenticated arbitrary order cancellation. This issue stems from a lack of authentication and authorization checks within the handle checkout redirecturl response() function. Consequently, an unauthenticated attacker can cancel any WooCommerce order by submitting a crafted request containing a valid order ID.

Recommendations Update the plugin to version 1.3.2 or later. As a temporary workaround, restrict access to the handle checkout redirecturl response() function until the update is applied.