Description
The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a payments status through server-side validation though the /wc-api/bp-payeer-gateway-callback endpoint. This makes it possible for unauthenticated attackers to update unpaid order statuses to paid resulting in a loss of revenue.
Published: 2025-11-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Payment Bypass
Action: Apply Patch
AI Analysis

Impact

The Crypto Payment Gateway with Payeer for WooCommerce plugin allows attackers to change the status of an unpaid order to paid without authentication. The flaw is caused by missing server‑side validation on the /wc-api/bp-payeer-gateway-callback endpoint, which lets an attacker forge a request and trigger state changes. This results in unauthorized revenue loss and violates the integrity of transaction data.

Affected Systems

WordPress sites using the beycanpress Crypto Payment Gateway with Payeer for WooCommerce plugin, versions <= 1.0.3.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1% suggesting exploitation is unlikely but still possible. It is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the payment callback endpoint, allowing the attacker to modify order status server‑side.

Generated by OpenCVE AI on April 22, 2026 at 12:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Crypto Payment Gateway with Payeer for WooCommerce plugin to the latest version that includes the server‑side payment status validation.
  • If an immediate update is not possible, block external access to the /wc-api/bp-payeer-gateway-callback endpoint or restrict it to trusted IP addresses only.
  • Implement server‑side checks to verify that payment callbacks originate from the legitimate Payeer service before changing order status.

Generated by OpenCVE AI on April 22, 2026 at 12:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Beycanpress
Beycanpress crypto Payment Gateway With Payeer For Woocommerce
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Beycanpress
Beycanpress crypto Payment Gateway With Payeer For Woocommerce
Woocommerce
Woocommerce woocommerce
Wordpress
Wordpress wordpress

Tue, 04 Nov 2025 04:45:00 +0000

Type Values Removed Values Added
Description The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a payments status through server-side validation though the /wc-api/bp-payeer-gateway-callback endpoint. This makes it possible for unauthenticated attackers to update unpaid order statuses to paid resulting in a loss of revenue.
Title Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Beycanpress Crypto Payment Gateway With Payeer For Woocommerce
Woocommerce Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:49:12.817Z

Reserved: 2025-10-16T19:01:24.095Z

Link: CVE-2025-11890

cve-icon Vulnrichment

Updated: 2025-11-04T16:47:55.464Z

cve-icon NVD

Status : Deferred

Published: 2025-11-04T05:16:04.337

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-11890

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T12:45:17Z

Weaknesses