PT-2026-1636 · WordPress+1 · Piraeus Bank Woocommerce Payment Gateway+1

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14460

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Piraeus Bank WooCommerce Payment Gateway plugin for WordPress versions through 3.1.4

Description The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is susceptible to unauthorized modification of order statuses. This is a result of lacking authorization checks within the payment callback endpoint handler when processing the 'fail' callback. An unauthenticated attacker can alter the status of any order to 'failed' by utilizing the WooCommerce API endpoint and providing the order ID (MerchantReference parameter). Order IDs are sequential integers, making enumeration straightforward. This could lead to business disruption, including canceled shipments, inventory problems, and financial losses. The vulnerable API endpoint is '/wc/v3/orders/{order id}'.

Recommendations Versions prior to and including 3.1.4 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14460

Affected Products

Piraeus Bank Woocommerce Payment Gateway

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14460 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d7b15198-8f44-4390-862b-35d41eb8a854?source=cve · Note
• https://twitter.com/CVEnew/status/2008838574238564740 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woo-payment-gateway-for-piraeus-bank/trunk/classes/WC_Piraeusbank_Gateway.php#L821 · Note
• https://plugins.trac.wordpress.org/changeset/3439515 · Note
• https://plugins.trac.wordpress.org/browser/woo-payment-gateway-for-piraeus-bank/tags/3.1.4/classes/WC_Piraeusbank_Gateway.php#L821 · Note