What is the CVSS score of CVE-2026-25443?

CVE-2026-25443 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-25443?

An authentication bypass vulnerability in the Dotstore Fraud Prevention For WooCommerce plugin allows unauthenticated attackers to delete arbitrary content from affected WordPress sites.

How to fix or mitigate CVE-2026-25443?

Within 24 hours: Audit all WordPress installations for the Dotstore Fraud Prevention plugin and document affected versions; implement WAF rules to block unauthorized API requests to plugin endpoints. Within 7 days: Disable the plugin on all affected instances or migrate to an alternative fraud prevention solution; conduct a content audit for unauthorized deletions. Within 30 days: Implement application-level access controls and monitoring; establish a vendor communication protocol to track patch availability.

WordPress CVE-2026-25443

EUVD-2026-13081 HIGH

Missing Authorization (CWE-862)

2026-03-19 audit@patchstack.com

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 09:22 euvd

EUVD-2026-13081

Analysis Generated

Mar 19, 2026 - 09:22 vuln.today

CVE Published

Mar 19, 2026 - 09:16 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fraud Prevention For Woocommerce: from n/a through 2.3.3.

AnalysisAI

Dotstore Fraud Prevention For Woocommerce versions through 2.3.3 contain an authorization bypass vulnerability that allows unauthenticated attackers to manipulate access control settings and cause denial of service. The missing authorization checks enable remote exploitation without user interaction, affecting WordPress installations using this plugin. No patch is currently available for this vulnerability.

Technical ContextAI

This vulnerability is rooted in CWE-862 (Missing Authorization), which occurs when the software does not perform authorization checks when an actor attempts to access a resource or perform an action. The Fraud Prevention For WooCommerce plugin (also known as woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers in the plugin directory) fails to properly verify user permissions before allowing access to sensitive functionality. The CVSS vector indicates this is a network-accessible vulnerability requiring no privileges or user interaction, specifically impacting availability rather than confidentiality or integrity. The plugin is designed to prevent fraudulent WooCommerce orders and manage customer blacklists, but the missing authorization checks expose administrative functions to unauthorized access.

RemediationAI

Users should immediately upgrade the Fraud Prevention For WooCommerce plugin to a version newer than 2.3.3 that addresses this authorization vulnerability. Check the WordPress plugin repository or Dotstore's official channels for the patched release and apply it through the WordPress admin dashboard. Until patching is complete, consider temporarily disabling the plugin if fraud prevention operations can be managed through alternative means, or implement web application firewall rules to restrict access to the plugin's administrative endpoints to authenticated administrator IP addresses only. Review the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/vulnerability/wordpress-fraud-prevention-for-woocommerce-plugin-2-3-2-arbitrary-content-deletion-vulnerability for additional technical details and detection guidance.