CVE-2025-12883

MEDIUM

Campay Woocommerce Payment Gateway <1.2.2 - Auth Bypass

Title source: llm

Description

The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset?old_path=/campay-api/tags/1.2.2&new_path=/campay-api/tags/1.2.3&sfp_email=&sfph_mail=

Product

https://wordpress.org/plugins/campay-api/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/2f12fa00-6108-4bd4-9310-8558211f4d0f?source=cve

Scores

CVSS v3 5.3

EPSS 0.0013

EPSS Percentile 31.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

campay/Campay Woocommerce Payment Gateway < 1.2.2

Published Dec 12, 2025

Tracked Since Feb 18, 2026