EUVD-2025-17515
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
3Description
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Stock Locations for WooCommerce: from n/a through 2.8.6.
Analysis
Missing Authorization vulnerability in Fahad Mahmood's Stock Locations for WooCommerce plugin (versions up to 2.8.6) that allows authenticated users with low privileges to perform unauthorized actions including information disclosure and availability disruption. An attacker with basic user credentials can bypass access controls to modify stock locations or trigger denial-of-service conditions due to improper privilege verification. This vulnerability has a CVSS score of 7.1 (High) and affects WooCommerce installations using the vulnerable plugin; KEV status and active exploitation data are not currently confirmed in public advisories.
Technical Context
The vulnerability exists in the Stock Locations for WooCommerce plugin, which extends WooCommerce's e-commerce functionality to manage inventory across multiple warehouse or storage locations. The root cause is CWE-862 (Missing Authorization), indicating the plugin fails to properly enforce role-based access control (RBAC) checks before executing sensitive operations. Rather than verifying user capabilities via WordPress's capability system (e.g., manage_woocommerce, edit_products), the plugin likely exposes administrative or restricted endpoints to authenticated users without sufficient privilege validation. This affects the plugin across all versions from the initial release through version 2.8.6, with the vulnerability residing in action handlers, AJAX endpoints, or REST API routes that interact with stock location data. CPE identifier would be: cpe:2.3:a:fahad_mahmood:stock_locations_for_woocommerce:*:*:*:*:*:wordpress:*:* (versions <=2.8.6).
Affected Products
Stock Locations for WooCommerce (0.0.0 through 2.8.6 (inclusive))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today