Oceanpayment CreditCard Gateway CVE-2025-11728
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote callbacks with missing auth checks give AV:N/AC:L/PR:N/UI:N; impact is limited to order/transaction data tampering, so I:L with C:N/A:N.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
AnalysisAI
Unauthenticated attackers can tamper with WooCommerce order status and transaction IDs on stores running the Oceanpayment CreditCard Gateway plugin versions up to and including 6.0 because the plugin's return_payment and notice_payment functions lack authentication and capability checks. This is a remote, unauthenticated issue with only integrity impact (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N); EPSS is low at 0.34%, and no public exploit identified at time of analysis. The practical risk is low-to-moderate and limited to sites that actively use this specific WooCommerce gateway, where exploitation can disrupt order workflows and corrupt transaction records.
Technical ContextAI
The Oceanpayment CreditCard Gateway is a WordPress plugin that extends WooCommerce with a payment gateway. The vulnerability is CWE-306 (Missing Authentication for Critical Function), arising because the callback handlers return_payment and notice_payment in class-wc-oceancreditcard.php perform state-changing actions, updating an order to failed and altering transaction IDs, without verifying that the request is authenticated or that the caller has the necessary WooCommerce capabilities. The code references point to lines 489 and 594 of the plugin's main class. Because these are remote HTTP callbacks, any party able to reach the WordPress site can invoke them on a default installation where the plugin is active; the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms network reachability, no privileges, no user interaction, and limited integrity impact. There is no confidentiality or availability impact, and exploitation requires WooCommerce plus the Oceanpayment CreditCard Gateway plugin.
Affected ProductsAI
Oceanpayment CreditCard Gateway plugin for WordPress, all versions up to and including 6.0, when installed and active on a site running WooCommerce. No CPE strings were provided in the input data. The vendor code references are in class-wc-oceancreditcard.php at lines 489 and 594 (https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L489 and https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L594). The Wordfence advisory is https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=cve. The provided data does not specify a fixed version.
RemediationAI
Apply the vendor's fixed release for Oceanpayment CreditCard Gateway as soon as it is available and confirmed; the provided data does not specify an exact patched version, so verify against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=cve and the plugin's Trac page for a version beyond 6.0. If no fixed version is available, deactivate and remove the plugin, accepting that the store will lose this payment gateway until a patched version is validated and an alternative gateway is configured; this is the most reliable mitigation because it removes the vulnerable callbacks entirely. If removal is not feasible, restrict public access to the return_payment and notice_payment endpoints using WAF or web-server rules, ideally allowing only expected Oceanpayment source IPs or requiring a valid gateway signature or token, with the trade-off that overly strict rules can block legitimate payment notifications and leave orders in inconsistent states. Also monitor WooCommerce orders for unexpected status changes to failed and review transaction IDs for unauthorized modifications.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today