What is the CVSS score of CVE-2025-11888?

CVE-2025-11888 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

ShopEngine CVE-2025-11888

LOW

Incorrect Authorization (CWE-863)

2025-10-25 security@wordfence.com

WordPress Authentication Bypass Woocommerce Wordpress Plugin

2.7

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Network-reachable low-complexity call but requires an elevated Editor+ account (PR:H); only license activation state is altered, giving I:L with no C or A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 17:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 16:55 vuln.today

CVE Published

Oct 25, 2025 - 06:15 cve.org

LOW 2.7

DescriptionCVE.org

The ShopEngine Elementor WooCommerce Builder Addon - All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.

AnalysisAI

Incorrect authorization in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.8.4) lets an authenticated user with Editor-level capabilities or higher reach the plugin's license-management routes and activate or deactivate the site's license without proper permission checks. The flaw is confined to license state manipulation - there is no path to code execution or data disclosure - and the vendor shipped a fix in version 4.8.5. No active exploitation is indicated (not in CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is 0.22% (12th percentile), consistent with a low-severity, low-real-risk issue.

Technical ContextAI

This is a CWE-863 (Incorrect Authorization) defect in a WordPress plugin's licensing subsystem. ShopEngine registers AJAX/REST-style license routes in libs/license/license-route.php, and the post_activate() and post_deactive() handlers perform an insufficient capability check before toggling license state. Because the handlers rely on a weak or missing current_user_can() gate rather than a dedicated license-management capability, any logged-in account at Editor level or above inherits the ability to change license status. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N confirms network reachability and low integrity impact only, with no confidentiality or availability impact, and PR:H indicates the attacker must already hold a privileged authenticated role. The upstream changeset (tags/4.8.5/libs/license/license-route.php) shows the corrected capability enforcement introduced in 4.8.5. Note that one intelligence tag labels this an 'Authentication Bypass', which overstates the issue: no authentication is bypassed - the attacker must already be authenticated with elevated privileges.

Affected ProductsAI

The ShopEngine Elementor WooCommerce Builder Addon - All in One WooCommerce Solution plugin for WordPress, all versions up to and including 4.8.4. The vulnerable component is libs/license/license-route.php, specifically the post_activate() and post_deactive() license handlers. Sites running 4.8.5 or later are patched and not affected. No CPE strings were supplied by the sources; affected installs are identified by the WordPress plugin slug 'shopengine'. Vendor/upstream advisory and patch detail: https://plugins.trac.wordpress.org/changeset/3381211/shopengine/tags/4.8.5/libs/license/license-route.php and the Wordfence threat-intel entry https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdadc84-0cfb-4bec-aeb9-f59f205d269b?source=cve. Any WordPress site with an active ShopEngine installation at 4.8.4 or earlier is in scope, regardless of whether WooCommerce or Elementor content is heavily used.

RemediationAI

Apply the vendor fix by updating ShopEngine to version 4.8.5 or later - this is the primary and complete remediation, and the corrected capability check is visible in the 4.8.5 changeset at https://plugins.trac.wordpress.org/changeset/3381211/shopengine/tags/4.8.5/libs/license/license-route.php (see also the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdadc84-0cfb-4bec-aeb9-f59f205d269b?source=cve). If immediate update is not possible, reduce exposure by auditing which accounts hold Editor or higher roles and temporarily downgrading or removing that capability from users who do not genuinely need it, since the flaw requires Editor-level access or above to trigger; note the trade-off that this restricts legitimate content-authoring workflows for those users. Blocking or filtering requests to the plugin's license-route endpoint at the WAF or web-server layer can also blunt exploitation, but such rules are brittle against route renaming and should be treated as a stopgap rather than a substitute for upgrading. No vendor-released workaround exists that fully closes the issue without the version update; deleting license state or disabling the plugin is a heavier option that removes the licensing UI functionality entirely.