CVE-2025-11728CWE-306

CVE-2025-11728

Medium · published October 15, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-10-15T13:15Z
References (3)
https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L489 · [email protected]https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L594 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=cve · [email protected]
EPSS history
Timeline
  • 15 OCT 08:26Z
    Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update
    cvelistv5