Unauthorized Order Status Modification in Piraeus Bank WooCommerce Payment Gateway

CVE-2025-14460

What is CVE-2025-14460?

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress has a vulnerability that allows unauthorized modification of order statuses in any version up to 3.1.4. This exploit stems from inadequate authorization checks on the payment callback endpoint handler, specifically when handling the 'fail' callback from the payment gateway. As a result, unauthenticated attackers can manipulate the status of any order to 'failed' by simply inputting the order's ID, which is publicly accessible and can be easily iterated due to its sequential nature. This flaw poses a considerable risk to online retailers, leading to potential disruptions in order management, inventory control, and financial losses.

References