Premmerce Wholesale Pricing CVE-2025-64285
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible plugin requiring low-privilege WordPress authentication (PR:L); missing authorization causes limited integrity and availability harm with no confidentiality impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.
AnalysisAI
Missing authorization controls in Premmerce Wholesale Pricing for WooCommerce (versions through 1.1.10) permit authenticated low-privileged users to invoke restricted plugin functionality without proper capability checks, resulting in unauthorized data modification and limited availability disruption. The CVSS vector (PR:L) confirms exploitation requires an authenticated WordPress account, constraining the attack surface to registered users. EPSS at 0.03% (10th percentile) and absence from CISA KEV indicate negligible observed exploitation activity at time of analysis.
Technical ContextAI
CWE-862 (Missing Authorization) describes a code path where the application performs a sensitive operation without verifying whether the caller holds the necessary permission or capability. In WordPress/WooCommerce plugin architecture, this typically means the plugin registers AJAX handlers, REST endpoints, or admin-post hooks without calling current_user_can() or equivalent capability checks. Premmerce Wholesale Pricing for WooCommerce manages B2B wholesale price tiers, customer group assignments, and minimum order quantities - operations that should be gated behind administrator or shop-manager capabilities. The flaw allows a user authenticated at subscriber or customer level (PR:L per CVSS) to trigger these operations. No CPE string was supplied in source data; affected scope is confirmed as plugin versions n/a through 1.1.10 per the Patchstack advisory.
Affected ProductsAI
Premmerce Wholesale Pricing for WooCommerce plugin by Premmerce is affected across all versions from the initial release through and including version 1.1.10. No CPE string was included in the provided source data. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wholesale-pricing/vulnerability/wordpress-premmerce-wholesale-pricing-for-woocommerce-plugin-1-1-10-broken-access-control-vulnerability?_s_id=cve is the authoritative reference for confirmed version bounds.
RemediationAI
The primary remediation is to update the Premmerce Wholesale Pricing for WooCommerce plugin to a version beyond 1.1.10 as soon as one is released by the vendor; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wholesale-pricing/vulnerability/wordpress-premmerce-wholesale-pricing-for-woocommerce-plugin-1-1-10-broken-access-control-vulnerability?_s_id=cve for the confirmed fixed version, which was not independently confirmed in the data available at time of analysis. As a compensating control pending a patch, restrict new user registration on affected WooCommerce sites and audit existing registered accounts to ensure no untrusted users hold active accounts; this does not eliminate the flaw but removes the PR:L foothold required for exploitation. Additionally, a WordPress Web Application Firewall (WAF) rule targeting unauthorized wholesale-pricing endpoint access can reduce exposure, though rule tuning may cause false positives for legitimate wholesale customers.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today