CVE-2025-15512

Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation

Published Jan 14, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to set any WooCommerce order to `pending payment` status.

Analysis

Technical impact

The Aplazo Payment Gateway plugin for WordPress contains a missing capability check in the check_success_response() function, which allows an una user to alter the status of any WooCommerce order to pending payment. This unauthorized modification undermines order integrity and can lead to fraudulent transactions or revenue loss. The weakness is classified as CWE‑862, a lack of authorization.

Affected Systems

The vulnerability affects installations of the Aplazo Payment Gateway WordPress plugin up to and including version 1.4.3. Any site that has not upgraded beyond 1.4.3 is susceptible. No other product versions are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The flaw is not currently listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request that triggers the vulnerable function; due to the missing authorization check, an attacker can manipulate order status without authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aplazopayment

Aplazo Payment Gateway

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.4.3

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Aplazo Payment Gateway to the latest version (≥1.4.4) which includes the proper authorization check.
Ensure that only users with the appropriate capabilities (e.g., Shop Manager or higher) can invoke order status changes.
If a plugin update cannot be applied immediately, remove or restrict the check_success_response endpoint or disable order status modifications for unauthenticated users.

Generated by OpenCVE AI on April 21, 2026 at 16:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.270% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/aplazo-payment-gateway/tags/1.4.2/includes/module/class-aplazo-module.php#L206
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457434%40aplazo-payment-gateway&new=3457434%40aplazo-payment-gateway&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/97b327cc-7a72-4cc3-a4db-a693469f6917?source=cve

History

Apr 8, 2026 5:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to set any WooCommerce order to `pending payment` status.	The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to set any WooCommerce order to `pending payment` status.
Title	Aplazo Payment Gateway <= 1.4.2 - Missing Authorization to Unauthenticated Order Status Manipulation	Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457434%40aplazo-payment-gateway&new=3457434%40aplazo-payment-gateway&sfp_email=&sfph_mail=

Jan 15, 2026 8:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Jan 14, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 14, 2026 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to set any WooCommerce order to `pending payment` status.
Title		Aplazo Payment Gateway <= 1.4.2 - Missing Authorization to Unauthenticated Order Status Manipulation
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/aplazo-payment-gateway/tags/1.4.2/includes/module/class-aplazo-module.php#L206 https://www.wordfence.com/threat-intel/vulnerabilities/id/97b327cc-7a72-4cc3-a4db-a693469f6917?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`