What is the CVSS score of CVE-2025-11741?

CVE-2025-11741 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

WPC Smart Quick View CVE-2025-11741

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-10-18 security@wordfence.com

WordPress Authentication Bypass Information Disclosure Woocommerce Wordpress Plugin

5.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated AJAX endpoint (AV:N/AC:L/PR:N/UI:N) leaks only restricted product data, so C:L with no integrity or availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 23:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 22:58 vuln.today

CVE Published

Oct 18, 2025 - 07:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.

AnalysisAI

Unauthenticated attackers can read product data that should be hidden - password-protected, private, and draft WooCommerce products - on any WordPress site running the WPC Smart Quick View for WooCommerce plugin in all versions up to and including 4.2.5. The flaw is an access-control weakness in the plugin's 'woosq_quickview' AJAX endpoint, which does not sufficiently restrict which posts it will render, so a caller can supply the identifier of a non-public product and receive its content; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is limited to confidentiality of product records - no writes, no account takeover, and no access to non-product content - and there is no public exploit code and no confirmed active exploitation at time of analysis, with EPSS at 0.34% (25th percentile).

Technical ContextAI

The WPC Smart Quick View for WooCommerce plugin adds a 'quick view' modal to WooCommerce storefronts and serves its content through the WordPress AJAX action 'woosq_quickview'. WordPress routes such requests through admin-ajax.php, and actions registered for unauthenticated visitors (the wp_ajax_nopriv_* pattern) are reachable without a session - which matches the CVSS vector's PR:N/UI:N. The weakness is CWE-639 (Authorization Bypass Through User-Controlled Key), an insecure-direct-object-reference class: the handler accepts a client-supplied post/product identifier and builds its output without verifying that the referenced object is published and publicly viewable, so posts with post_status of 'private' or 'draft', or published products guarded by a password, are rendered just like public ones. WooCommerce products are ordinary WordPress posts of type 'product', so the same post-visibility checks that core applies in its own query logic (and that the plugin omits) are what normally prevent this disclosure. The result is an enumeration-driven data leak: the attacker needs only a valid product ID and the default endpoint, with the practical ceiling on impact set by how much sensitive content the store keeps in non-public product records.

Affected ProductsAI

The WPC Smart Quick View for WooCommerce WordPress plugin, all versions up to and including 4.2.5, is affected; the defect is in the plugin's 'woosq_quickview' AJAX handler and therefore applies to every installation of that version range regardless of theme or hosting. The primary intelligence source is the vendor plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old=3379189%40woo-smart-quick-view&new=3379189%40woo-smart-quick-view, which records the upstream code change, alongside Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/220487de-2a1c-47ec-ac65-db1af44aed3d?source=cve. No CPE identifiers were supplied in the input, so affected instances should be identified by plugin slug (woo-smart-quick-view) and version rather than by CPE matching; WooCommerce itself must be active for the plugin's functionality - and therefore the vulnerable endpoint - to be meaningful.

RemediationAI

The upstream fix is recorded in the plugin changeset 3379189 (https://plugins.trac.wordpress.org/changeset?old=3379189%40woo-smart-quick-view&new=3379189%40woo-smart-quick-view), so an upstream fix is available, but a released patched version number is not independently confirmed in the supplied data - administrators should check the WordPress.org plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/220487de-2a1c-47ec-ac65-db1af44aed3d?source=cve) for the exact fixed release and update to it, or to any version above 4.2.5, as soon as it is published. If immediate upgrade is not possible, the most effective compensating control is to block or restrict unauthenticated requests to the 'woosq_quickview' action on admin-ajax.php (for example with a WAF or web-server rule matching action=woosq_quickview and no valid session); the trade-off is that the quick-view modal will stop working for logged-out shoppers, degrading storefront UX for legitimate visitors. A lower-impact alternative is to deactivate WPC Smart Quick View entirely until a patched release is installed, which removes the exposed endpoint but also removes the feature. Because the leak only has substance when hidden product records exist, auditing the catalogue and avoiding storage of sensitive data (supplier costs, embargoed product details, unlaunched items) in draft, private, or password-protected product statuses reduces exposure but does not fix the underlying authorization flaw; note that no public exploit code or confirmed active exploitation has been observed, so this should be prioritised as a routine, moderate-severity patch rather than an emergency response.