CVE-2025-12355

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-05

Last updated on: 2025-12-08

Assigner: Wordfence

Description

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-05

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12355

EUVD

EUVD-2025-201357

Affected Vendors & Products

Vendor	Product	Version / Range
adedeji_a	payaza	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Payaza plugin for WordPress has a vulnerability where it does not properly check user permissions on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint. This allows unauthenticated attackers to modify order statuses without authorization.

Impact Analysis

This vulnerability can allow attackers to change order statuses without permission, potentially leading to unauthorized manipulation of order data, which could disrupt business operations or cause financial discrepancies.

Mitigation Strategies

Immediate mitigation steps include disabling or uninstalling the Payaza plugin until a patched version is released, as the plugin has been temporarily closed and is unavailable for download pending a full security review. Additionally, restrict access to the 'wp_ajax_nopriv_update_order_status' AJAX endpoint if possible, and monitor your WordPress site for unauthorized changes to order statuses. [1]

Hi! I’m here to help you understand CVE-2025-12355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70