PT-2026-3356 · WordPress · Paygent For Woocommerce

Benachi + 1 · Published 2026-01-17 · Updated 2026-01-17 · CVE-2025-14078

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PAYGENT for WooCommerce plugin versions prior to 2.4.6

Description The PAYGENT for WooCommerce plugin for WordPress is susceptible to a missing authorization issue. This occurs because of a lack of authorization checks within the paygent check webhook function, combined with the paygent permission callback function consistently returning true. This allows unauthenticated attackers to manipulate payment callbacks and alter order statuses by sending fabricated payment notifications to the /wp-json/paygent/v1/check/ endpoint.

Recommendations Update the PAYGENT for WooCommerce plugin to a version later than 2.4.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14078

Affected Products

Paygent For Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14078 · Security Note
• https://twitter.com/CVEnew/status/2012490338913390690 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9de42bd9-a1d2-48f2-a594-4013a9490e25?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-for-paygent-payment-main/trunk/includes/gateways/paygent/class-wc-paygent-endpoint.php#L199 · Note
• https://twitter.com/VulmonFeeds/status/2012471248823923097 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-for-paygent-payment-main/tags/2.4.2/includes/gateways/paygent/class-wc-paygent-endpoint.php#L199 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3433179%40woocommerce-for-paygent-payment-main&new=3433179%40woocommerce-for-paygent-payment-main&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3432342%40woocommerce-for-paygent-payment-main&new=3432342%40woocommerce-for-paygent-payment-main&sfp_email=&sfph_mail= · Note