PT-2026-5879 · WordPress · Xendit Payment

Published 2026-02-04 · Updated 2026-02-04 · CVE-2025-14461

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xendit Payment plugin for WordPress versions up to and including 6.0.2

Description The Xendit Payment plugin for WordPress is susceptible to unauthorized modification of order statuses. This occurs because the plugin exposes a publicly accessible WooCommerce API callback endpoint, /wc xendit callback, which processes payment callbacks without verifying the request's origin from Xendit's payment gateway. An unauthenticated attacker can send a crafted POST request to this endpoint with a JSON body containing an external id corresponding to an order ID and a status of 'PAID' or 'SETTLED'. Successful exploitation allows attackers to fraudulently mark orders as completed, potentially leading to financial loss and inventory depletion. The attacker needs to enumerate order IDs, which are sequential integers, to successfully exploit this issue.

Recommendations Update the Xendit Payment plugin to a version beyond 6.0.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14461

Affected Products

Xendit Payment

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14461 · Security Note
• https://plugins.trac.wordpress.org/changeset/3457724 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2791bbd5-9101-4484-a352-0e4d2ce04e5d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woo-xendit-virtual-accounts/tags/6.0.2/woocommerce-xendit-pg.php#L252 · Note
• https://t.me/CVEtracker/43697 · Telegram Post
• https://t.me/cveNotify/150827 · Telegram Post
• https://plugins.trac.wordpress.org/browser/woo-xendit-virtual-accounts/trunk/woocommerce-xendit-pg.php#L252 · Note