What is the CVSS score of CVE-2025-15484?

CVE-2025-15484 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-15484?

Order Notification for WooCommerce plugin versions before 3.6.3 contain a critical authorization bypass that allows unauthenticated attackers to read and modify all store data, including products,…. A patch is available.

How to fix or mitigate CVE-2025-15484?

Within 24 hours: Verify all WordPress installations and identify those running Order Notification for WooCommerce versions prior to 3.6.3 using plugin management dashboards or security scanners. Within 7 days: Update all affected installations to version 3.6.3 or later via WordPress admin console or command-line tools; disable the plugin on any instances where immediate patching is not feasible. Within 30 days: Conduct log analysis for the 90 days preceding patch deployment to identify unauthorized access to store data, orders, or customer information; implement Web Application Firewall (WAF) rules to restrict unauthenticated access to WooCommerce API endpoints as defense-in-depth.

WordPress CVE-2025-15484

EUVD-2025-209160 CRITICAL

Improper Authentication (CWE-287)

2026-04-01 contact@wpscan.com

GHSA-9h28-9gg8-2pm4

WordPress Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.3

EUVD ID Assigned

Apr 01, 2026 - 06:22 euvd

EUVD-2025-209160

Analysis Generated

Apr 01, 2026 - 06:22 vuln.today

CVE Published

Apr 01, 2026 - 06:16 nvd

CRITICAL 9.1

DescriptionCVE.org

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.

AnalysisAI

Order Notification for WooCommerce WordPress plugin versions before 3.6.3 disable WooCommerce's authentication and permission checks, allowing unauthenticated remote attackers to read and modify all store data including products, coupons, orders, and customer information. This critical authorization bypass affects all WordPress installations using the vulnerable plugin without version restriction, and no public exploit code availability or active exploitation status has been confirmed at time of analysis.

Technical ContextAI

The Order Notification for WooCommerce plugin (WordPress plugin ecosystem, CPE scope: wordpress:order-notification-for-woocommerce) integrates with WooCommerce's REST API and backend data access layers. The vulnerability stems from improper permission handling in the plugin's request processing logic, where the plugin overrides or bypasses WooCommerce's standard permission checks (typically role-based access control via wp_capabilities and nonce verification). This represents a broken access control flaw in the authorization layer rather than a cryptographic or injection-based vulnerability. The plugin's API endpoints or action hooks are processing unauthenticated requests without verifying user identity or capabilities, allowing direct manipulation of WooCommerce resources that should require administrative or vendor privileges.

RemediationAI

Update Order Notification for WooCommerce plugin to version 3.6.3 or later immediately via WordPress plugin dashboard or direct download. This is the primary fix released by the vendor to restore proper permission checks. In the interim, if immediate patching is not possible, disable the Order Notification for WooCommerce plugin entirely to prevent unauthorized API access, then re-enable only after applying the patch. Verify the update via the WPScan advisory (https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/) and confirm the active plugin version matches 3.6.3 or higher. Additionally, audit WooCommerce access logs and database records for suspicious changes to products, customers, coupons, or orders that may have occurred while the vulnerable version was active.