Campay Woocommerce Payment Gateway
Campay Woocommerce Payment Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).
The one issue recorded for Campay Woocommerce Payment Gateway has a vendor fix available, so running the current release closes it.
All of these findings were reported by Md. Moniruzzaman Prodhan (NomanProdhan). Campay Woocommerce Payment Gateway is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.10.
CVE-2025-12883Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass
Read the full analysisVulnerability Records

Campay Woocommerce Payment Gateway
Author
campay
CamPay is a Cameroonian fintech service of TAKWID GROUP, running since January 2021. It lets businesses and organisations collect and send money online, mainly through MTN Mobile Money and Orange Money. This plugin adds CamPay as a payment method to WooCommerce. How customers pay Mobile Money: at checkout the customer chooses CamPay, enters their 9-digit MTN or Orange number, places the order and approves the payment on their phone with their PIN. To approve a pending payment they can dial 126# (MTN) or #15050# (Orange). The order times out after a few minutes without confirmation. Debit or credit card: the customer clicks “Click here to pay using a credit or debit card” and pays on a secure CamPay page. Cards are only offered when you enable them and card payments are activated on your CamPay account. Features MTN Mobile Money and Orange Money, with phone number validation Debit and credit card payments on the secure CamPay page Test mode with the CamPay demo environment Store currency in FCFA (XAF), or in US dollars or euros converted to XAF with your own rates Webhook secured with the CamPay Webhook Key, to record payments confirmed later Real CamPay API errors in the WooCommerce logs and as private notes on the order Translations: English (GB, US) and French Requirements WooCommerce installed and active PHP 8.1 or greater A CamPay account and app: sign up on campay.net (or demo.campay.net to test) For card payments: card payments activated on your CamPay account External services This plugin connects to the CamPay API (https://www.campay.net, or https://demo.campay.net in test mode) to process payments. It is required for the gateway to work. Authentication: when the checkout is displayed with card processing enabled, and when an order is paid, your App Username and App Password are sent to get an access token. Card availability: when the checkout is displayed with card processing enabled, the plugin asks CamPay whether cards are activated on your account. Mobile Money payment: when a customer places an order, the amount in XAF, the customer’s phone number, a description (site address and order number) and a unique reference are sent. The payment status is then checked until it is confirmed. Card payment: when a customer pays by card, the amount in XAF, a description, the order number and the return address on your store are sent to create the payment page. The customer enters card details on the CamPay page, not on your site. Webhook: CamPay calls your store when a transaction is completed; the call is checked with your Webhook Key. CamPay is provided by TAKWID GROUP: terms and conditions, privacy policy. API documentation: CamPay API.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C