Oceanpayment CreditCard Gateway, CVE-2025-11728

CVE, Research URL: CVE-2025-11728
Home page URL: Security reports for Oceanpayment CreditCard Gateway
Application: Oceanpayment CreditCard Gateway
Published on: Oct 15, 2025
Research Description: The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
Affected versions: max 6.0.
Status: vulnerable