CVE-2025-14843
Unauthenticated Arbitrary Order Cancellation in Wizit Gateway WooCommerce Plugin
Publication date: 2026-01-24
Last updated on: 2026-01-24
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wizit | wizit_gateway_for_woocommerce | to 1.2.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Wizit Gateway for WooCommerce plugin (up to version 1.2.9) allows unauthenticated attackers to cancel arbitrary WooCommerce orders. This happens because the 'handle_checkout_redirecturl_response' function lacks proper authentication and authorization checks, enabling attackers to send crafted requests with valid order IDs to cancel orders without permission. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to cancel legitimate WooCommerce orders without authentication. This could disrupt your order processing, cause financial loss, damage customer trust, and create operational issues in your e-commerce store. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring for unauthenticated HTTP requests attempting to cancel WooCommerce orders via the 'handle_checkout_redirecturl_response' function. Specifically, look for HTTP requests containing crafted parameters with valid order IDs targeting the Wizit Gateway for WooCommerce plugin endpoints. Network monitoring tools or web server logs can be searched for such suspicious requests. However, no specific detection commands are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the Wizit Gateway for WooCommerce plugin until a patched version beyond 1.2.9 is available, or restricting access to the plugin's endpoints to authenticated users only. Additionally, review and tighten authentication and authorization checks around order cancellation processes in WooCommerce. Monitoring and logging suspicious cancellation requests can also help mitigate exploitation risks. [1]