Payment Bypass Vulnerability in Crypto Payment Gateway for WooCommerce by WordPress

CVE-2025-11890

What is CVE-2025-11890?

The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is susceptible to a payment bypass vulnerability across all versions up to and including 1.0.3. This vulnerability arises from the plugin's failure to adequately verify payment statuses via server-side validation at the /wc-api/bp-payeer-gateway-callback endpoint. Consequently, this security gap allows unauthenticated attackers to manipulate unpaid order statuses, changing them to 'paid' without the proper verification, which can lead to significant financial losses for merchants.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References