PT-2025-50811 · WordPress · Pays – Woocommerce Payment Gateway

Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-12883

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Campay Woocommerce Payment Gateway versions up to and including 1.2.2

Description The Campay Woocommerce Payment Gateway plugin for WordPress is susceptible to an unauthenticated payment bypass. The plugin does not adequately verify that a transaction has been completed through the payment gateway. This allows unauthenticated attackers to circumvent payment processes and falsely mark orders as successful, potentially leading to financial loss.

Recommendations Update the Campay Woocommerce Payment Gateway plugin to a version later than 1.2.2.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12883

Affected Products

Pays – Woocommerce Payment Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12883 · Security Note
• https://t.me/cveNotify/145547 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2f12fa00-6108-4bd4-9310-8558211f4d0f?source=cve · Note
• https://wordpress.org/plugins/campay-api · Note
• https://plugins.trac.wordpress.org/changeset?old_path=/campay-api/tags/1.2.2&new_path=/campay-api/tags/1.2.3&sfp_email=&sfph_mail= · Note