PT-2026-4856 · Unknown+1 · Woocommerce+1

Published 2026-01-27 · Updated 2026-01-27 · CVE-2025-14971

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Link Invoice Payment for WooCommerce versions up to and including 2.8.0

Description The Link Invoice Payment for WooCommerce plugin for WordPress has a flaw where data can be modified without authorization. This is due to a missing capability check in the createPartialPayment and cancelPartialPayment functions. Unauthenticated attackers can create partial payments for any order or cancel existing partial payments by enumerating IDs.

Recommendations Update Link Invoice Payment for WooCommerce to a version later than 2.8.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14971

Affected Products

Link Invoice Payment For Woocommerce

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14971 · Security Note
• https://t.me/cveNotify/149955 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=cve · Note
• https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L19 · Note
• https://t.me/CVEtracker/43040 · Telegram Post
• https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L179 · Note
• https://twitter.com/CVEnew/status/2016055009277050923 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016051467233247562 · Twitter Post