ShopMagic CVE-2025-69093
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Missing authorization on a network-reachable endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is limited to a minor unauthorized state change, so C:N/I:L/A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
AnalysisAI
ShopMagic for WooCommerce through version 4.7.2 fails to enforce an authorization (capability) check on at least one plugin action, so an unauthenticated remote attacker can invoke functionality that should be restricted to privileged users. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication, no user interaction and no special timing are needed, but the achievable impact is limited to a low-integrity state change - no data disclosure, no denial of service, and no server-side code execution is implied by the assessed vector. EPSS is only 0.22% (11th percentile) and there is no CISA KEV entry, and no public exploit identified at time of analysis, so this is a high-reach, low-impact misconfiguration rather than an emergency-priority issue; exploitation still requires the plugin to be installed and active on a reachable WordPress site.
Technical ContextAI
The root cause is CWE-862 (Missing Authorization) in the wpdesk ShopMagic automation/marketing plugin for WooCommerce - a web application access-control class rather than a memory-safety or injection flaw. ShopMagic registers WordPress AJAX/REST-style handlers and admin actions that are expected to be gated behind capability checks (for example manage_woocommerce or manage_options); the reported 'Incorrectly Configured Access Control Security Levels' indicates one such endpoint is registered without verifying the caller's role or nonce, so the handler runs for any network client that can reach it. The CPE/tag data places this squarely in the WordPress plugin ecosystem (wordpress, plugin: shopmagic-for-woocommerce), and the Patchstack advisory classifies it as a broken access control / authentication bypass. Because the handler executes in the WordPress request context, the attacker inherits whatever the plugin action can do, which the vector bounds to an integrity-only state change.
Affected ProductsAI
ShopMagic for WooCommerce (wordpress-shopmagic-plugin, slug shopmagic-for-woocommerce) from an unspecified earlier release through 4.7.2 inclusive, on any WordPress installation where the plugin is installed and active, paired with WooCommerce. The vendor/plugin author is wpdesk, and the affected component is whatever ShopMagic action or endpoint lacks a capability check; all earlier 4.x releases in the affected range are presumed vulnerable per the advisory wording 'from n/a through <= 4.7.2'. The authoritative product and version guidance is the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/shopmagic-for-woocommerce/vulnerability/wordpress-shopmagic-plugin-4-7-2-broken-access-control-vulnerability?_s_id=cve, which should be checked for the precise fixed release.
RemediationAI
No vendor-released patch version is identified in the available data, so the first step is to open the Patchstack advisory referenced above and the wpdesk ShopMagic changelog to confirm which release (likely the first version after 4.7.2) contains the authorization fix, then update the plugin to that version - WordPress users can do this from Dashboard > Plugins or via WP-CLI ('wp plugin update shopmagic-for-woocommerce'). If no fix is yet available, apply compensating controls: deactivate ShopMagic on any site that does not actively rely on its automations (removes the attack surface entirely at the cost of losing those automations); restrict reachability of the plugin's admin-ajax/REST endpoints and /wp-admin paths at the WAF or reverse proxy so unauthorized POSTs to ShopMagic actions are blocked; and enable a WAF rule targeting unauthenticated requests to the affected action, accepting that legitimate front-end-triggered automations (e.g. opt-in, cart recovery) may break if the rule is too broad. Additionally, audit ShopMagic logs and WordPress audit trails for unexpected state changes made by anonymous requests prior to remediation, and harden general site posture by keeping WooCommerce and WordPress core current.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today