PT-2026-5090 · WordPress · Rupantorpay

Published 2026-01-28 · Updated 2026-01-28 · CVE-2025-15511

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rupantorpay plugin for WordPress versions through 2.0.0

Description The Rupantorpay plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the handle webhook() function. An unauthenticated attacker can exploit this to modify WooCommerce order statuses by sending specifically crafted requests to the WooCommerce API endpoint. The vulnerable function is handle webhook().

Recommendations Update the Rupantorpay plugin to a version newer than 2.0.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15511

Affected Products

Rupantorpay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-15511 · Security Note
• https://t.me/cveNotify/150111 · Telegram Post
• https://twitter.com/CVEnew/status/2016473950188974184 · Twitter Post
• https://plugins.trac.wordpress.org/browser/rupantorpay/tags/2.0.0/includes/class-wc-rupantorpay-gateway.php#L172 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1b21bdfd-42ec-43fe-b581-04276b86c50b?source=cve · Note