CVE-2025-62935
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
Analysis
Missing authorization controls in the Open Close WooCommerce Store plugin (versions ≤4.9.9) allow authenticated low-privileged users to bypass access restrictions and perform unauthorized high-impact operations, potentially modifying store configuration or accessing sensitive data. With CVSS 8.1 (High severity) but only 0.03% EPSS (9th percentile), this represents a significant vulnerability for affected WordPress/WooCommerce sites, though no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. The authentication requirement (PR:L) substantially limits attack surface compared to unauthenticated vulnerabilities.
Technical Context
This vulnerability stems from CWE-862 (Missing Authorization), a common security weakness in WordPress plugins where access control checks are improperly implemented or entirely absent. The Open Close WooCommerce Store plugin, which provides store opening/closing schedule functionality for WooCommerce shops, fails to properly validate user permissions before executing privileged operations. In WordPress environments, this typically occurs when plugin developers rely solely on user authentication without verifying role-based capabilities before performing sensitive actions like configuration changes or data access. The CVSS vector indicates network-based exploitation with low complexity and no user interaction required, though authenticated access with low privileges is necessary. The vulnerability affects the confidentiality and integrity of the system (both rated High) but does not impact availability, suggesting attackers can read sensitive information and modify data but cannot crash or disable the store.
Affected Products
The vulnerability affects the Open Close WooCommerce Store plugin (woc-open-close) developed by StackWC for WordPress platforms, specifically all versions from the earliest release through version 4.9.9 inclusive. This plugin integrates with WooCommerce e-commerce platform to provide store scheduling functionality. According to Patchstack's vulnerability database, version 4.9.8 was explicitly identified with broken access control issues, with the vulnerability persisting through 4.9.9. The plugin is distributed through the WordPress plugin repository and affects WordPress sites running WooCommerce with this scheduling extension installed. Site operators can verify their installation version through the WordPress admin dashboard under Plugins section.
Remediation
Site administrators should immediately update the Open Close WooCommerce Store plugin to version 4.9.10 or later, which contains vendor-released security patches addressing the missing authorization controls. Update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or manually download the latest version from the official WordPress plugin repository. As an interim workaround until patching, restrict plugin access by auditing and removing unnecessary low-privilege user accounts, particularly subscriber and customer roles that should not require administrative plugin access. Review WordPress user roles and capabilities to ensure principle of least privilege. Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woc-open-close/ for additional remediation guidance and confirmation of fixed versions. Consider temporarily disabling the plugin if store scheduling functionality is non-critical until patches can be applied and validated.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today