CVE-2025-14078

The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing authorization checks on the paygent_check_webhook function combined with the paygent_permission_callback function unconditionally returning true on line 199. This makes it possible for unauthenticated attackers to manipulate payment callbacks and modify order statuses by sending forged payment notifications via the `/wp-json/paygent/v1/check/` endpoint.

• CWE-862

• https://plugins.trac.wordpress.org/browser/woocommerce-for-paygent-payment-main/tags/2.4.2/includes/gateways/paygent/class-wc-paygent-endpoint.php#L199
• https://plugins.trac.wordpress.org/browser/woocommerce-for-paygent-payment-main/trunk/includes/gateways/paygent/class-wc-paygent-endpoint.php#L199
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3432342%40woocommerce-for-paygent-payment-main&new=3432342%40woocommerce-for-paygent-payment-main&sfp_email=&sfph_mail=
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3433179%40woocommerce-for-paygent-payment-main&new=3433179%40woocommerce-for-paygent-payment-main&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9de42bd9-a1d2-48f2-a594-4013a9490e25?source=cve

Published

Jan 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14072The Ninja Forms WordPress plugin before 3.13.3 allows unaut…5.3
• CVE-2025-14073The WooCommerce PayPal Payments plugin for WordPress is vuln…5.3
• CVE-2025-14074The PDF for Contact Form 7 + Drag and Drop Template Builder …4.3
• CVE-2025-14075The WP Hotel Booking plugin for WordPress is vulnerable to S…5.3
• CVE-2025-14076The iXML – Google XML sitemap generator plugin for WordPress…6.1
• CVE-2025-14077The Simcast plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2025-14079The ELEX WordPress HelpDesk & Customer Ticketing System plug…5.3
• CVE-2025-1408The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2025-14080The Frontend Post Submission Manager Lite plugin for WordPre…5.3
• CVE-2025-14081The Ultimate Member plugin for WordPress is vulnerable to Pr…4.3
• CVE-2025-14082A flaw was found in Keycloak Admin REST (Representational St…2.7
• CVE-2025-14083A flaw was found in the Keycloak Admin REST API. This vulner…2.7