CVE-2025-15511

Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification

Published Jan 28, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.

Analysis

Technical impact

A missing capability check in the handle_webhook() function of the Rupantorpay WordPress plugin allows an unauthenticated attacker to send crafted requests to the WooCommerce order status API endpoint and alter order statuses, such as cancelling, completing, or refunding orders, without any authorization.

Affected Systems

The vulnerability affects all releases of the Rupantorpay plugin through version 2.0.0, inclusive. Users who have installed any of these affected versions are potentially exposed.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any network by forging HTTP requests to the WooCommerce order status API endpoint, making the attack vector reachable but currently unlikely to be widely targeted.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rupantorpay

Rupantorpay

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.0

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Rupantorpay plugin to the latest available version that includes the missing capability check fix.
If an update is not yet available, restrict access to the WooCommerce order status API endpoint so that only authenticated, authorized users can modify order statuses, or disable the endpoint that allows status changes entirely.
Enable detailed logging of all order status updates and monitor logs for unexpected changes to detect and respond to unauthorized activity.

Generated by OpenCVE AI on April 22, 2026 at 20:07 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.244% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/rupantorpay/tags/2.0.0/includes/class-wc-rupantorpay-gateway.php#L172
https://www.wordfence.com/threat-intel/vulnerabilities/id/1b21bdfd-42ec-43fe-b581-04276b86c50b?source=cve

History

Jan 29, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Jan 28, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 28, 2026 11:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.
Title		Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/rupantorpay/tags/2.0.0/includes/class-wc-rupantorpay-gateway.php#L172 https://www.wordfence.com/threat-intel/vulnerabilities/id/1b21bdfd-42ec-43fe-b581-04276b86c50b?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`