EUVD-2025-209160
GHSA-9h28-9gg8-2pm4
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
Analysis
Order Notification for WooCommerce WordPress plugin versions before 3.6.3 disable WooCommerce's authentication and permission checks, allowing unauthenticated remote attackers to read and modify all store data including products, coupons, orders, and customer information. This critical authorization bypass affects all WordPress installations using the vulnerable plugin without version restriction, and no public exploit code availability or active exploitation status has been confirmed at time of analysis.
Technical Context
The Order Notification for WooCommerce plugin (WordPress plugin ecosystem, CPE scope: wordpress:order-notification-for-woocommerce) integrates with WooCommerce's REST API and backend data access layers. The vulnerability stems from improper permission handling in the plugin's request processing logic, where the plugin overrides or bypasses WooCommerce's standard permission checks (typically role-based access control via wp_capabilities and nonce verification). This represents a broken access control flaw in the authorization layer rather than a cryptographic or injection-based vulnerability. The plugin's API endpoints or action hooks are processing unauthenticated requests without verifying user identity or capabilities, allowing direct manipulation of WooCommerce resources that should require administrative or vendor privileges.
Affected Products
Order Notification for WooCommerce WordPress plugin versions prior to 3.6.3 are affected. The plugin integrates with WooCommerce (version compatibility not specified in advisory) and WordPress (no minimum version restriction indicated). All installations of the plugin below version 3.6.3 are vulnerable. Patch confirmation and detailed version compatibility information are available via the WPScan vulnerability report at https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/
Remediation
Update Order Notification for WooCommerce plugin to version 3.6.3 or later immediately via WordPress plugin dashboard or direct download. This is the primary fix released by the vendor to restore proper permission checks. In the interim, if immediate patching is not possible, disable the Order Notification for WooCommerce plugin entirely to prevent unauthorized API access, then re-enable only after applying the patch. Verify the update via the WPScan advisory (https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/) and confirm the active plugin version matches 3.6.3 or higher. Additionally, audit WooCommerce access logs and database records for suspicious changes to products, customers, coupons, or orders that may have occurred while the vulnerable version was active.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today