PT-2025-46580 · Unknown+1 · Woocommerce+1

Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-12903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Braintree For WooCommerce versions up to and including 3.2.78

Description The Payment Plugins Braintree For WooCommerce plugin for WordPress is susceptible to authorization bypass. This is caused by a missing capability check on the /wc-braintree/v1/3ds/vaulted nonce API endpoint. The endpoint is registered with permission callback set to return true, allowing processing of user-supplied token IDs without authentication or ownership verification. This enables unauthenticated attackers to retrieve payment method nonces for any stored payment token, potentially leading to fraudulent transactions, unauthorized charges, or attachment of payment methods to other subscriptions. The vulnerable parameter is the token ID.

Recommendations Update Braintree For WooCommerce to a version later than 3.2.78.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12903

Affected Products

Braintree For Woocommerce

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12903 · Security Note
• https://t.me/cveNotify/142501 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/89cd5429-39a0-441f-ba69-dea111eae5ed?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392259%40woo-payment-gateway&new=3392259%40woo-payment-gateway&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1988529795949642220 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988567514909958328 · Twitter Post
• https://developer.wordpress.org/rest-api/using-the-rest-api/authentication · Note
• https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L35 · Note
• https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L23 · Note