Unauthorized Order Status Manipulation in Xendit Payment Plugin for WordPress

CVE-2025-14461

What is CVE-2025-14461?

The Xendit Payment plugin for WordPress is susceptible to unauthorized manipulation of order statuses due to a lack of authentication on its WooCommerce API callback endpoint. Versions up to 6.0.2 allow attackers to send crafted POST requests to the wc_xendit_callback URL, enabling them to mark any WooCommerce order as paid without valid payment confirmation. Unscrupulous actors can exploit this vulnerability to fraudulently complete orders, leading to significant financial repercussions and inventory shortages for businesses.

References