Authorization Bypass Vulnerability in Payment Plugins Braintree for WooCommerce

CVE-2025-12903

What is CVE-2025-12903?

The Payment Plugins Braintree For WooCommerce plugin for WordPress has a significant authorization bypass vulnerability due to the lack of a capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint. This flaw affects all versions up to and including 3.2.78, as the endpoint is improperly set with a permission callback that allows any user to access it. This permits unauthorized attackers to extract payment token IDs from the system without any authentication, enabling them to create fraudulent transactions, charge customer credit cards unjustly, or associate payment methods to other subscriptions.

References