CVE-2025-12903

🗓️ 12 Nov 2025 08:28:04Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 13 Views🌐 WEB

Unauthorized access to payment tokens in Braintree for WooCommerce ≤3.2.78 enables nonce retrieval and fraud.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-12903	12 Nov 202510:09	–	circl
CNNVD	WordPress plugin Payment Plugins Braintree For WooCommerce 安全漏洞	12 Nov 202500:00	–	cnnvd
CNVD	WordPress Payments Braintree For WooCommerce plugin authorization bypass vulnerability	14 Nov 202500:00	–	cnvd
Cvelist	CVE-2025-12903 Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud	12 Nov 202508:28	–	cvelist
EUVD	EUVD-2025-119984	12 Nov 202508:28	–	euvd
NVD	CVE-2025-12903	12 Nov 202509:15	–	nvd
Patchstack	WordPress Payment Plugins Braintree For WooCommerce plugin <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud vulnerability	12 Nov 202505:12	–	patchstack
Positive Technologies	PT-2025-46580	12 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12903	13 Nov 202509:08	–	redhatcve
Vulnrichment	CVE-2025-12903 Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud	12 Nov 202508:28	–	vulnrichment

Vulners

Node

paymentplugins payment_plugins_braintree_for_woocommerceRange≤3.2.78wordpress

[
  {
    "vendor": "paymentplugins",
    "product": "Payment Plugins Braintree For WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.2.78",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/89cd5429-39a0-441f-ba69-dea111eae5ed
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php
plugins	www.plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php
plugins	www.plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php
developer	www.developer.wordpress.org/rest-api/using-the-rest-api/authentication/

Parameter	Position	Path	Description	CWE
token_id	request body	wc-braintree/v1/3ds/vaulted_nonce	Authorization bypass via unauthenticated access to vaulted_nonce endpoint allowing retrieval of payment method nonces for any stored token without ownership/authentication.	CWE-639

15 Apr 2026 00:35Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.17.5

EPSS0.00449

SSVC

CWE-639