CVE-2025-12883

Executive Summary

CVE-2025-12883 is a critical unauthenticated payment bypass vulnerability affecting the Campay WooCommerce Payment Gateway plugin for WordPress, up to and including version 1.2.2. The flaw resides in the plugin's failure to properly validate that a transaction has actually occurred through the Campay payment gateway. This allows an unauthenticated attacker to manipulate order statuses, marking them as "completed" without any payment, leading to a direct loss of revenue for the merchant. The vulnerability is classified as a Missing Authorization (CWE-862) issue and has a CVSS score of 5.3 (Medium). No public exploit code or patch is currently available, making this a high-priority issue for all affected WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Campay WooCommerce Payment Gateway plugin is distributed through the official WordPress plugin repository and is installed directly by site administrators. There is no associated NPM, PyPI, Go, or Ruby package. The risk is entirely within the WordPress supply chain, where outdated or unmaintained plugins can introduce critical security flaws. Site owners must ensure they are using the latest version of the plugin and monitor for any official patches from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can modify order statuses, but not other data.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the CVSS score is moderate, the business impact can be severe for e-commerce sites, as it directly enables fraudulent transactions and revenue loss.

Deep Dive & Mechanics

The vulnerability stems from the plugin's order processing logic. When a customer completes a purchase, the WooCommerce order status is typically updated only after a successful payment confirmation from the Campay gateway. However, in vulnerable versions, the plugin does not verify that a valid transaction ID or payment confirmation was received from Campay's servers. Instead, it trusts client-side or unauthenticated server-side requests to mark an order as "completed."

Attack Flow:

1. An attacker initiates a checkout on a WooCommerce site using the Campay gateway.
2. The attacker intercepts or crafts the HTTP request that the plugin uses to update the order status (e.g., via a webhook or AJAX endpoint).
3. The attacker sends a request to the vulnerable endpoint (e.g., /wp-json/campay/v1/order-complete or similar) with the order ID and a fabricated "success" status.
4. The plugin, lacking proper validation, updates the order status to "completed" without any actual payment.
5. The attacker receives the goods or services without paying.

The core issue is a Missing Authorization (CWE-862) and Improper Input Validation (CWE-20). The plugin fails to check if the request originates from a trusted source (Campay's servers) and does not validate the integrity of the payment confirmation data.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// In a vulnerable version, the endpoint does not verify the source.
add_action( 'rest_api_init', function () {
    register_rest_route( 'campay/v1', '/order-complete', array(
        'methods' => 'POST',
        'callback' => 'campay_order_complete',
        'permission_callback' => '__return_true' // No authentication!
    ) );
} );

function campay_order_complete( $request ) {
    $order_id = $request->get_param( 'order_id' );
    $order = wc_get_order( $order_id );
    $order->update_status( 'completed' );
    return new WP_REST_Response( 'Order completed', 200 );
}

Patched Code (Conceptual):

// Patched version adds signature verification and nonce checks.
add_action( 'rest_api_init', function () {
    register_rest_route( 'campay/v1', '/order-complete', array(
        'methods' => 'POST',
        'callback' => 'campay_order_complete',
        'permission_callback' => function() {
            // Verify a shared secret or signature from Campay.
            $signature = $_SERVER['HTTP_X_CAMPAY_SIGNATURE'];
            $payload = file_get_contents('php://input');
            $expected = hash_hmac('sha256', $payload, CAMPAY_SECRET);
            return hash_equals($expected, $signature);
        }
    ) );
} );

function campay_order_complete( $request ) {
    // Additional validation: check transaction ID exists in Campay's system.
    $transaction_id = $request->get_param( 'transaction_id' );
    if ( ! campay_verify_transaction( $transaction_id ) ) {
        return new WP_REST_Response( 'Invalid transaction', 403 );
    }
    $order_id = $request->get_param( 'order_id' );
    $order = wc_get_order( $order_id );
    $order->update_status( 'completed' );
    return new WP_REST_Response( 'Order completed', 200 );
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Campay WooCommerce Payment Gateway plugin (version <= 1.2.2) installed and active.
• Knowledge of the vulnerable REST API endpoint (e.g., /wp-json/campay/v1/order-complete).

Exploitation Steps:

1. Identify the Endpoint: Use a tool like Burp Suite or curl to discover the exact endpoint. Common patterns include /wp-json/campay/v1/order-complete or /wp-json/campay/v1/payment-callback.
2. Create a Test Order: Add a product to the cart and proceed to checkout. Note the order ID from the WooCommerce admin or the URL.
3. Craft the Exploit Request: Send a POST request to the vulnerable endpoint with the order ID and a fabricated success status.

Example Exploit (curl):

curl -X POST https://target-site.com/wp-json/campay/v1/order-complete \
  -H "Content-Type: application/json" \
  -d '{"order_id": 123, "status": "completed"}'

Expected Result: The order with ID 123 will be marked as "completed" in WooCommerce, and the attacker can download digital goods or trigger fulfillment.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to /wp-json/campay/v1/* endpoints from IPs not belonging to Campay's official servers.
• Alert on any order status change from "pending" to "completed" without a corresponding payment transaction ID.

Hardening:

• Immediate: Disable the Campay plugin until a patch is available.
• Network: Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from untrusted IPs.
• Code: If you have access to the plugin code, add signature verification as shown in the patched code example.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/campay/v1/order-complete or similar endpoints.
  • Requests containing order_id and status parameters without a valid transaction_id.
• File IOCs:
  • Modified order statuses in the WordPress database (wp_posts table where post_type = 'shop_order' and post_status = 'wc-completed').
• Log IOCs:
  • WooCommerce order notes indicating a status change without a payment gateway reference.
  • Web server access logs showing repeated POST requests to the Campay REST endpoint from a single IP.

Detection Engineering

YARA Rule

rule CVE_2025_12883_Campay_Payment_Bypass {
    meta:
        description = "Detects Campay WooCommerce Payment Gateway plugin files vulnerable to CVE-2025-12883"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12883"
    strings:
        $vuln_func = "campay_order_complete" nocase
        $vuln_route = "campay/v1/order-complete" nocase
        $no_auth = "__return_true" nocase
    condition:
        all of them
}

Sigma Rule

title: Campay WooCommerce Payment Gateway Unauthenticated Payment Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-12883 by monitoring for unauthenticated POST requests to the Campay order completion endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/campay/v1/order-complete'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate Campay callbacks (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-12883 Campay WooCommerce Payment Bypass Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-json/campay/v1/order-complete";
    http_uri;
    content:"order_id";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and remove the Campay WooCommerce Payment Gateway plugin until an official patch is released.
2. Audit Orders: Review all orders marked as "completed" since the plugin was installed. Cross-reference with Campay transaction logs to identify fraudulent orders.
3. Implement WAF Rules: Block POST requests to /wp-json/campay/v1/* from IPs not in Campay's official IP range.

Long-Term Fixes:

• Vendor Patch: Apply the official patch from Campay as soon as it becomes available.
• Code Hardening: If you maintain the plugin, add HMAC signature verification and server-side transaction validation as shown in the patched code example.
• Monitor for Updates: Subscribe to WordPress plugin update notifications and apply security patches promptly.

Workaround (if plugin must remain active):

• Use a reverse proxy or server-level rewrite to require authentication for the vulnerable endpoint.
• Implement a custom function that hooks into woocommerce_order_status_completed to verify the payment transaction ID before allowing the status change.

Valters IT
Securing Digital Frontiers