PT-2026-5879 · WordPress · Xendit Payment

CVE-2025-14461 · Publicado 2026-02-04 · Atualizado 2026-02-04

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xendit Payment plugin for WordPress versions up to and including 6.0.2

Description The Xendit Payment plugin for WordPress is susceptible to unauthorized modification of order statuses. This occurs because the plugin exposes a publicly accessible WooCommerce API callback endpoint, /wc xendit callback, which processes payment callbacks without verifying the request's origin from Xendit's payment gateway. An unauthenticated attacker can send a crafted POST request to this endpoint with a JSON body containing an external id corresponding to an order ID and a status of 'PAID' or 'SETTLED'. Successful exploitation allows attackers to fraudulently mark orders as completed, potentially leading to financial loss and inventory depletion. The attacker needs to enumerate order IDs, which are sequential integers, to successfully exploit this issue.

Recommendations Update the Xendit Payment plugin to a version beyond 6.0.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14461

Produtos afetados

Xendit Payment

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14461 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3457724 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/2791bbd5-9101-4484-a352-0e4d2ce04e5d?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/woo-xendit-virtual-accounts/tags/6.0.2/woocommerce-xendit-pg.php#L252 · Nota
• https://t.me/CVEtracker/43697 · Publicação no Telegram
• https://t.me/cveNotify/150827 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/woo-xendit-virtual-accounts/trunk/woocommerce-xendit-pg.php#L252 · Nota