Unauthenticated Data Modification Vulnerability in Oceanpayment CreditCard Gateway for WordPress

CVE-2025-11728

What is CVE-2025-11728?

The Oceanpayment CreditCard Gateway plugin for WordPress is susceptible to unauthorized modification due to insufficient authentication and capability checks on critical functions. This vulnerability allows unauthenticated attackers to potentially alter WooCommerce order statuses to 'failed' and manipulate transaction IDs, posing significant risks to e-commerce operations. It affects all versions up to and including 6.0, necessitating immediate attention from site administrators to secure their installations.

References