{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12355", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T15:32:06.345Z", "datePublished": "2025-12-05T06:07:19.571Z", "dateUpdated": "2026-04-08T17:14:58.326Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:58.326Z"}, "affected": [{"vendor": "bigmaster", "product": "Payaza", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.3.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses."}], "title": "Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acc88688-76e0-4477-8b7c-eeff541881ab?source=cve"}, {"url": "https://wordpress.org/plugins/payaza/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "timeline": [{"time": "2025-12-04T17:31:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T13:41:34.333733Z", "id": "CVE-2025-12355", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T13:41:41.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12355", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T13:41:34.333733Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T13:41:38.558Z"}}], "cna": {"title": "Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update", "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "bigmaster", "product": "Payaza", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.3.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T17:31:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acc88688-76e0-4477-8b7c-eeff541881ab?source=cve"}, {"url": "https://wordpress.org/plugins/payaza/"}], "descriptions": [{"lang": "en", "value": "The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:58.326Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12355", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:58.326Z", "dateReserved": "2025-10-27T15:32:06.345Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T06:07:19.571Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses."}], "id": "CVE-2025-12355", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-05T07:16:10.660", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/payaza/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acc88688-76e0-4477-8b7c-eeff541881ab?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:05:52.422473+00:00", "value": {"mitigation_remediation": ["Upgrade the Payaza plugin to the latest release, which includes a proper capability check for the update order status endpoint.", "If an upgrade is not immediately feasible, add a temporary restriction by disabling the wp_ajax_nopriv_update_order_status action for unauthenticated users, for example by removing the action or applying a capability check via custom code or a security plugin.", "After applying a fix, audit transaction logs for any anomalous changes to order statuses and notify the site administrators of any suspicious activity."], "summary": {"action": "Update plugin", "impact": "Unauthenticated order status modification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Payaza plugin developed by bigmaster, released under the bigmaster:Payaza vendor. All versions of the plugin up to and including 0.3.8 are impacted. Users running Payaza on a WordPress site with any of these versions can be targeted.", "description_and_impact": "The Payaza plugin for WordPress contains a missing capability check on the wp_ajax_nopriv_update_order_status AJAX endpoint. This flaw allows an attacker without any authentication to invoke the endpoint and arbitrarily change the status of orders. Such unauthorized modifications can lead to fraudulent order handling, potential financial loss, and undermining the integrity of the store\u2019s transaction records. The weakness corresponds to CWE\u2011862, a missing authorization failure.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending an HTTP request to the wp_ajax_nopriv_update_order_status endpoint without authentication, typically by crafting a POST request with parameters that set the desired order status. The flaw does not require any special privileges or initial compromise, making it a straightforward unauthenticated data modification vector."}}}}, "created": "2025-12-05T20:56:29.874484+00:00", "updated": "2026-04-21T01:15:20.123307+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}