Security readout for executives and security teams
Plain-English summary
Wizit Gateway for WooCommerce versions through 1.3.1 allow an unauthenticated internet user who knows a valid order ID to cancel that order. The issue can disrupt sales and create customer-service or fulfillment problems, but the supplied sources do not indicate data theft or complete site compromise.
Executive priority
Treat as a prompt operational fix for stores using the affected plugin. Although rated medium, successful abuse could cancel revenue-generating orders without authentication. Prioritize public, high-volume stores and investigate unexplained cancellations; emergency incident status is not supported without local evidence of abuse.
Technical view
The plugin's handle_checkout_redirecturl_response function lacks authentication and authorization checks, classified as CWE-862. A crafted network request containing a valid WooCommerce order ID can alter order state without credentials or user interaction. CVSS 3.1 rates it 5.3, with low integrity impact and no stated confidentiality or availability impact.
Likely exposure
Exposure is likely where Wizit Gateway for WooCommerce version 1.3.1 or earlier is installed and its affected checkout response handler is internet-accessible. Successful abuse also requires a valid order ID. The supplied evidence does not establish how readily attackers can obtain those IDs.
Exploitation context
The weakness is remotely reachable, low complexity, requires no privileges, and needs no victim interaction. However, the source bundle marks it absent from KEV and provides no evidence of active exploitation. Its demonstrated consequence is arbitrary order cancellation, not code execution or information disclosure.
Researcher notes
The affected function and missing access checks are specifically identified, and the WordPress Trac references include historical source and a changeset. The supplied bundle does not explicitly name the first corrected version or describe the changeset, so remediation should be verified against vendor guidance. Do not infer active exploitation from remote reachability alone.
Mitigation direction
- Inventory WordPress sites for Wizit Gateway for WooCommerce version 1.3.1 or earlier.
- Check vendor and WordPress plugin guidance for a release confirmed to address CVE-2025-14843.
- Update to the confirmed corrected release after testing checkout and payment workflows.
- If no corrected release is available, disable the plugin or restrict the affected integration until guidance is available.
- Review cancelled orders and reconcile them against legitimate customer or payment events.
Validation and detection
- Confirm the installed plugin version on every WooCommerce site.
- Verify the deployed version is outside the stated affected range and vendor-confirmed as corrected.
- Review application and web logs for unauthenticated requests reaching the checkout response handler.
- Identify unexpected order cancellations, especially those lacking matching customer, administrator, or payment-provider activity.
- Test legitimate checkout redirects after remediation without attempting unauthorized cancellation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-14843 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4WordfenceVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineWordfence
Discovered
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b6926c2c-79d4-477c-a2eb-ba62545f2e2b?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/wizit-gateway-for-woocommerce/tags/1.2.9/class-wizit-gateway.php?marks=1249,1341-1349#L1249CVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3474107/wizit-gateway-for-woocommerceCVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.