Woocommerce
Monthly
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Unauthorized order manipulation and information disclosure in the WooCommerce PayPal Payments WordPress plugin (versions through 4.0.1) allows remote unauthenticated attackers to abuse two WC-AJAX endpoints (ppc-create-order and ppc-get-order) that lack authorization checks. By chaining these endpoints, an attacker can create a PayPal order against any victim's WooCommerce order ID and then retrieve full PayPal order details including payer information and shipping data. No public exploit identified at time of analysis, but the plugin's broad e-commerce deployment and trivial attack complexity make this a credible target.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Unauthenticated information disclosure in the Track Orders for WooCommerce WordPress plugin before 1.2.7 lets anyone who already knows a customer's email address retrieve that customer's name, email, phone number, postal address and order history from the plugin's order-tracking lookup. The lookup returns billing details without ever verifying that the requester owns the referenced order, and because the CVSS vector confirms PR:N and UI:N, no account or interaction is needed - the only gating factor is prior possession of a valid customer email. No public exploit identified at time of analysis and no confirmed active exploitation (the flaw is not listed in CISA KEV), but CISA's SSVC assessment marks it automatable, and the vendor has released a fix in version 1.2.7.
Insufficient authorization in the Wallet System for WooCommerce WordPress plugin before 2.8.0 lets any authenticated user - a subscriber-level account is sufficient - file a withdrawal request against another user's wallet while freely choosing the amount and the payout destination. Because the plugin never checks that the wallet named in the submission belongs to the submitter, the attacker can also repeatedly lodge requests that indefinitely block the victim from making legitimate withdrawals of their own, producing an immediate denial-of-service effect even when no funds move. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; wallets with balances are the meaningful targets, and actual fund transfer typically still depends on an administrator approving the payout.
Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). Stores with open customer registration and the wallet-transfer feature enabled are directly exposed; no public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Information disclosure in the Wallet System for WooCommerce plugin before 2.8.0 allows any authenticated user on a WordPress site - the description states a subscriber-level account is sufficient - to generate and download a report containing every customer's wallet transaction history, including names, email addresses, user roles, transaction amounts, payment methods and dates. The report endpoint performs no capability check and instead trusts a token that the plugin renders on a front-end page, so any logged-in user can retrieve the token and then invoke the endpoint; no user interaction is required. The published base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while our assessment rates the confidentiality impact as High (C:H) because the exposure covers complete customer PII and the store's full financial transaction ledger. No public exploit code identified at time of analysis; patch available in 2.8.0.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin.
Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. There is no CISA KEV entry and no public exploit identified at time of analysis, so real-world priority is low-to-moderate; no EPSS score was supplied with the available intelligence.
Unauthenticated disclosure of other customers' uploaded files is possible through the File Uploads Addon for WooCommerce WordPress plugin in versions 1.7.2 through 1.7.5, because the plugin serves stored uploads without verifying that the requester is the customer who originally uploaded the file (CWE-639). An attacker who knows or guesses the exact file name of a previously uploaded file can retrieve it over the network with no account and no user interaction, as reflected by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9 Medium) - the High attack complexity stems entirely from the file-name discovery prerequisite, so real-world difficulty hinges on whether the plugin generates guessable or sequential names versus long random tokens. There is no public exploit identified at time of analysis, and the vendor has released a fix in 1.7.6.
Unauthenticated retrieval of customer-uploaded files is possible in the File Uploads Addon for WooCommerce WordPress plugin (versions 1.7.2 through 1.7.6), which stores customer submissions in a publicly web-accessible uploads directory while the access restriction it generates fails to actually block direct requests; an attacker who knows or can guess a file's name can fetch it straight from the web root, bypassing the plugin's authenticated download mechanism. The issue is a broken access control / insecure direct object reference problem (CWE-284) rather than a true authentication bypass, and only confidentiality of already-uploaded files is affected - no integrity or availability impact. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), the attack is unauthenticated and needs no user interaction, but the High attack-complexity component reflects that the attacker must correctly guess or otherwise learn the target filename; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Arbitrary modification of shipping information on WooCommerce orders is possible in the Razorpay for WooCommerce plugin before 4.8.8, allowing unauthenticated attackers to alter shipping details on orders they do not own. The flaw is a missing authorization check (CWE-639) on a REST API route used during checkout; publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile), indicating low predicted exploitation likelihood, and the vendor has released a patch in version 4.8.8.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.
Unauthenticated attackers can manipulate gift-card amounts in WebToffee Gift Cards for WooCommerce before 1.3.1 to bypass configured denominations and reduce or eliminate order totals, obtaining products without full payment. Publicly available exploit code exists, and the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms remote, unauthenticated, no-user-interaction exploitation with low integrity impact only. The affected component requires WordPress with the vulnerable plugin and WooCommerce gift-card purchasing enabled; no server or data compromise is involved.
Stored cross-site scripting in the Tabs Responsive WordPress plugin (through version 2.5) allows an authenticated shop manager holding product-tab editing capability to persist JavaScript inside a WooCommerce product tab, which then executes in the browser of any user who views that product page, including an administrator. Exploitation depends on a pre-existing WooCommerce installation, the attacker already possessing a shop manager or higher account, and victim interaction (the malicious tab must be rendered by another user), making this a privileged-insider or compromised-account scenario rather than anonymous remote access (CVSS vector PR:H/UI:R). No public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) status, and no vendor-released patch version is identified in the available data; the assessed impact is limited confidentiality and integrity loss within a changed scope (S:C/C:L/I:L/A:N).
Unauthorized affiliate action execution is possible in AFFI - Affiliate Marketing for WooCommerce through version 1.0.9 because an access-control check is missing, allowing unauthenticated remote attackers to perform a low-integrity action per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No public exploit code or CISA KEV entry was identified at time of analysis, so this is assessed as a modest-severity, integrity-only issue rather than an actively exploited urgent threat. The practical risk is abuse of the plugin's affiliate functionality on sites running the affected version.
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.
Cross-site request forgery (CSRF) in Razorpay Payment Links for WooCommerce versions 2.1.5 and earlier allows unauthenticated attackers to perform state-changing actions under an authenticated victim's session. Exploitation requires the victim to visit a malicious page or click a crafted link while logged into the WordPress site (UI:R), and the attack's success depends on the victim's privileges and the absence of CSRF mitigations like nonces or SameSite cookies. No public exploit code or active exploitation has been identified, and the moderate CVSS score of 5.4 reflects low integrity and availability impact with no confidentiality impact.
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
Unauthenticated remote attackers can mark pending WooCommerce orders as paid without completing payment by abusing the SUMIT Payment Gateway for WooCommerce plugin before version 4.0.0, which accepts payment notifications without validating them against the SUMIT payment provider. The vulnerability is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) and is confined to falsifying order payment status, i.e. financial fraud rather than site compromise; publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV). Risk is bounded mainly by the niche adoption of this specific gateway and by the fact that the integrity impact is limited to order state.
Unauthenticated attackers can view other customers' order details in NP Quote Request for WooCommerce versions 2.0 through 2.4.15 by supplying a valid order key, because the plugin fails to verify order ownership before rendering order details. Exploitation requires knowledge of a specific victim's order key (a pseudo-random token), which is the primary limiting factor and the reason for the high attack complexity (AC:H) in the CVSS vector; no authentication or user interaction is needed. This is a low-severity confidentiality flaw, and no public exploit code has been identified at time of analysis. The vendor has released version 2.4.16 to address the issue.
Missing authorization in the Points and Rewards for WooCommerce WordPress plugin before 2.10.4 allows an authenticated user holding only a Subscriber-level account to call the Win Wheel claim handler and credit their own account with an arbitrary, unlimited number of loyalty points; if the companion wallet plugin (same version line) is active, the fraudulently credited balance also extends to wallet funds. The flaw is remote and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N per independent assessment - note this rates integrity impact as High, above the 4.3 base score published with the CVE), and the only practical prerequisite is that the store has enabled the Win Wheel reward feature and permits open customer registration, which is typical for WooCommerce storefronts. Impact is integrity-only - loyalty point and wallet-balance fraud rather than site compromise or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor-released patch (2.10.4) is available.
Broken access control in the WC Fields Factory WordPress plugin before 4.1.11 allows an authenticated user holding Contributor-level privileges or higher to invoke the plugin's post-cloning action without any capability check or nonce verification. By doing so, the attacker can duplicate posts of any type or status - including private posts and drafts belonging to other users - and then read the resulting copy, effectively bypassing WordPress's normal content-access controls. The impact is limited to unauthorized read access to duplicated content rather than modification, deletion, or code execution, which keeps this a genuinely low-severity, low-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Information disclosure in the Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 through 5.7.2) lets authenticated users holding Contributor-level privileges or above enumerate and read other authors' private, draft, and trashed events, along with event detail that the normal listing view withholds. The flaw is an authorization/access-control defect (CWE-284) rather than remote code execution: it is read-only, requires an existing WordPress account with at least Contributor rights, and cannot be triggered by an anonymous visitor, so the practical risk depends heavily on how readily a site hands out contributor accounts. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has released a fix in version 5.7.3; our independent assessment rates this a genuinely low-priority issue and scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (the NVD vector's PR:H overstates the privilege bar relative to the contributor-level access described).
Unauthenticated information disclosure in the Product Badge, Label, Countdown Timer for WooCommerce plugin (versions 7.0.0 up to but not including 7.5.2) lets remote attackers retrieve the title, description, and price of products that are in draft, pending, or private status. The plugin returns product details without first verifying that the product is published, so any user who can reach the affected front-end functionality can enumerate unpublished catalog content; no authentication, user interaction, or special configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to confidentiality of product metadata - there is no write, code execution, or availability effect - and the practical exposure depends on whether the store actually holds sensitive unpublished products; no public exploit identified at time of analysis. A vendor patch is available in 7.5.2.
Authenticated users holding only contributor-level access on WordPress sites running the Paymob for WooCommerce plugin before 4.1.14 can delete, wipe, or modify the plugin's payment-gateway configuration, including stored Paymob payment credentials, because several admin-AJAX handlers omit a capability check (CWE-862 missing authorization). The affected site must have the plugin installed and active, and the attacker must first obtain a low-privilege account - via open registration or a compromised contributor user - after which no administrator interaction and no non-default configuration are required, yielding low confidentiality and availability impact but high integrity impact on the gateway configuration. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 4.1.14; despite the 'Authentication Bypass' tag applied by the reporter, the assessed nature of the flaw is an authorization gap, not a credential-free bypass.
Unauthenticated remote attackers can write forged card-token records into arbitrary user accounts and enumerate registered users on WordPress sites running the Paymob for WooCommerce plugin before version 4.1.14, because the card-token branch of the plugin's payment webhook never validates the request signature. Exploitation requires only that the site runs the affected plugin with its webhook endpoint reachable - no credentials, user interaction, or non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, NVD 5.3) - and impact is limited to unauthorized data writes and account enumeration rather than account takeover or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch (4.1.14) is available, so exposure is bounded by Paymob's regional (MENA) deployment footprint.
Missing authorization checks in the Social Commerce for WooCommerce WordPress plugin (versions through 2.5.4) leave several of its REST API endpoints reachable by unauthenticated users, allowing anyone who can reach the site to overwrite plugin configuration and product-synchronisation state. The flaw is CWE-862 (missing authorization) with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning exploitation requires no credentials or user interaction but is limited to partial integrity impact - no data disclosure and no denial of service. Exposure is restricted to WordPress sites running this specific niche plugin at a vulnerable version, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can capture another buyer's approved-but-uncaptured PayPal payment against a WooCommerce order of their own choosing in Payment Plugins for PayPal WooCommerce versions before 2.0.27. The plugin fails to confirm that the PayPal order supplied in a payment request actually belongs to the WooCommerce order being paid unless that PayPal order is already completed, so any store running the vulnerable plugin with the PayPal gateway active is exposed. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but gated by a timing prerequisite - a different buyer must have an approved, not-yet-captured PayPal order whose identifier the attacker can supply - yielding a conditional integrity impact (C:L/I:H/A:N, CVSS 6.5) rather than a high-urgency emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV). A vendor patch is available in 2.0.27.
WooCommerce PayPal Gateway before 9.2.1 allows unauthenticated attackers to mark their own orders as paid without paying the store by submitting a genuine PayPal transaction generated from a sandbox account they control. The plugin fails to verify that the payment notification came from the store's configured live payment environment and was paid to the store's merchant account, a business-logic flaw rated CVSS 5.3 (integrity impact only). No public exploit code or active exploitation has been identified, and stores running 9.2.1 or later are unaffected.
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Missing authorization checks in the PDF Builder for WooCommerce WordPress plugin (all versions up to and including 2.0.11) allow any authenticated user holding Subscriber-level access or above to read invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying attacker-chosen OrderNumber and InvoiceId values together with a garbage nonce. The prerequisite authentication is trivially met on stores that allow open customer registration, but the disclosure is confined to invoice metadata rather than full order or customer records, so impact is limited to low confidentiality (CVSS 4.3). No public exploit code has been identified at time of analysis, and an upstream fix is available via plugin repository changeset 3626297.
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.
Unauthenticated attackers can add arbitrary products to a WooCommerce cart and check out at the discounted price tied to a Frequently Bought Together campaign in the UpsellWP WordPress plugin (versions 1.4.4 through before 2.2.10), because the plugin never verifies that cart items actually belong to the campaign being applied. The flaw is a business-logic validation gap rather than a data-exposure or availability issue: the manipulation is limited to an integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), with real-world loss scaling to the size of the configured discount and the value of the goods sold. Publicly available exploit code exists, but there is no indication of confirmed active exploitation; the vendor has released a fix, so upgrading to 2.2.10 removes the issue.
Authenticated users, including a self-registered WooCommerce customer, can delete arbitrary media attachments belonging to other users on WordPress sites running the Checkout Field Manager (Checkout Manager) for WooCommerce plugin before version 7.9.7, because the plugin fails to verify attachment ownership before performing the delete. The flaw is a broken-authorization (CWE-862/IDOR) issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning the impact is limited to integrity of file data with no confidentiality loss or code execution, but any low-privilege account - not necessarily an administrator - is sufficient. Publicly available exploit code exists per the WPScan disclosure, and there is no confirmed active exploitation (CISA KEV); remediation is a straightforward upgrade to 7.9.7 or later.
Arbitrary media-attachment deletion in the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before version 7.9.7 lets any authenticated user - including a self-registered customer account - delete media attachments that belong to other users, because the plugin fails to verify ownership of the attachment before acting on it. The flaw is a classic IDOR (CWE-639) with limited impact: integrity only, no data disclosure, no remote code execution, and no site-wide outage, which is why the CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (published via WPScan), and no CISA KEV entry indicates confirmed active exploitation, but the low bar for exploitation on WooCommerce stores with default open customer registration means the practical risk is higher than the numeric score alone suggests.
Forged payment notifications against the Robokassa payment gateway for WooCommerce (all versions before 1.8.9) let unauthenticated remote attackers mark arbitrary WooCommerce orders as paid or on-hold without a real payment or a valid Robokassa signature. The flaw is only reachable when the plugin's non-default deferred-payment feature is explicitly enabled; default installations do not expose the vulnerable notification path. Despite a low CVSS base score of 3.7 and impact confined to order-status manipulation rather than data theft or site takeover, publicly available exploit code exists and the total absence of a signature check makes the callback path straightforward to abuse on affected configurations.
Authenticated users with only Subscriber-level WordPress accounts can rename arbitrary posts, pages, and WooCommerce products on sites running the Active Woot Products Tables for WooCommerce plugin before version 2.1.3, because several plugin AJAX actions perform neither capability nor CSRF nonce checks. Exploitation requires a valid low-privilege account (self-registration enabled or credentials otherwise obtained) and, for the CSRF route, a logged-in victim tricked into visiting a crafted page. Publicly available exploit code exists and the vendor has released a fix in 2.1.3; impact is limited to title/integrity tampering with no data disclosure, deletion, or code execution, so this is a low-to-moderate real-world risk.
Unauthenticated information disclosure in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 allows remote attackers to dump WooCommerce order details and customer contact information, target a specific order by identifier, and search the store's entire order set by customer name or email address. Exploitation requires only that the plugin be installed and active on a WordPress site with WooCommerce data present - no credentials, roles, or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - and publicly available exploit code exists alongside a WPScan-published proof of concept. Impact is limited to confidentiality (C:L) with no write or code-execution capability, and EPSS places exploitation likelihood at roughly 0.22% (13th percentile), making this a moderate-priority exposure whose real risk scales with the sensitivity and volume of customer records the store holds.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated order sabotage in WooCommerce Stripe Payment Gateway (all versions ≤10.7.0) allows any remote attacker to force pending WooCommerce orders into a 'failed' state without owning or authenticating against those orders. The root cause is a missing authorization check on the `ajax_pay_for_order()` function: the only gate is a nonce that is publicly available on any page where Express Checkout is enabled, providing no actual access control. Exploitation is trivially automatable via sequential order ID enumeration, enabling targeted disruption of an entire store's pending transactions. No public exploit has been identified at time of analysis, and no KEV listing exists, but the attack complexity is effectively zero for stores with Express Checkout active.
Unauthenticated attackers can modify WooPayments plugin settings through a missing capability check in the 'save_upe_appearance_ajax' AJAX function, affecting all versions up to and including 10.5.1. This allows remote attackers to alter payment appearance configurations without authentication, potentially disrupting payment processing or customer experience. No public exploit code or active exploitation has been identified at time of analysis.
ShopMagic for WooCommerce through version 4.7.2 fails to enforce an authorization (capability) check on at least one plugin action, so an unauthenticated remote attacker can invoke functionality that should be restricted to privileged users. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication, no user interaction and no special timing are needed, but the achievable impact is limited to a low-integrity state change - no data disclosure, no denial of service, and no server-side code execution is implied by the assessed vector. EPSS is only 0.22% (11th percentile) and there is no CISA KEV entry, and no public exploit identified at time of analysis, so this is a high-reach, low-impact misconfiguration rather than an emergency-priority issue; exploitation still requires the plugin to be installed and active on a reachable WordPress site.
DOM-based cross-site scripting in the Vidish Combo Offers WooCommerce plugin (woo-combo-offers) version 4.2 and earlier allows an authenticated attacker holding at least low-level privileges on a WordPress/WooCommerce site to inject script that executes in a victim's browser when the victim loads or interacts with the tainted page element. Exploitation requires both valid credentials (PR:L per the CVSS vector) and victim interaction (UI:R), so it is not reachable by a fully unauthenticated, zero-interaction attacker; the network attack vector and scope change (S:C) keep the score at 6.5, but the practical risk is low. No public exploit code has been identified and the CVE is not in CISA KEV, with an EPSS score of only 0.16% (5th percentile).
Stored cross-site scripting in the YITH WooCommerce Quick View WordPress plugin (all versions up to and including 2.7.0) allows an authenticated attacker holding contributor-level privileges or above to inject arbitrary JavaScript into pages through unsanitized attributes passed to the plugin's yith_quick_view shortcode. The payload is persisted in post/page content and executes in the browser of any visitor who later opens the affected page - most dangerously a higher-privileged user such as an administrator, which could lead to session or privilege abuse on the site. Severity is moderate (CVSS 6.4, scope changed) rather than critical: exploitation requires an existing contributor account, EPSS is only 0.29% (20th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can create arbitrary WooCommerce products on WordPress sites running the Eyewear Prescription Form plugin up to and including version 6.0.1, because the SubmitCatProductRequest AJAX action lacks any authorization or nonce checks. The flaw is rated CVSS 5.3 with an EPSS score of 0.27% (18th percentile); no public exploit has been identified at time of analysis, and exploitation requires WooCommerce to be installed alongside the plugin. Impact is limited to integrity (product creation) with no confidentiality or availability effect.
Missing authorization in the WordPress plugin Eyewear prescription form (all versions up to and including 6.0.1) lets unauthenticated remote attackers delete arbitrary WooCommerce product categories - including every child category beneath them - by invoking the plugin's RemoveItems AJAX action with attacker-controlled category IDs in the 'catIds' parameter. The CVSS vector (PR:N, UI:N) confirms exploitation requires no authentication and no user interaction, though impact is limited to integrity loss (I:L) on sites that both run WooCommerce and have the vulnerable plugin active. No public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the destructive-only, no-code-execution nature of the flaw.
Time-based blind SQL injection in the Payamito SMS WooCommerce plugin for WordPress (versions up to and including 1.3.5) allows unauthenticated attackers to extract sensitive database information via the 'columns' parameter. The vulnerability requires the plugin to be installed and active alongside WooCommerce, and exploitation is noisy due to the request-heavy nature of time-based blind extraction. No public exploit code was identified at time of analysis, and the EPSS score is 0.45% (37th percentile), indicating low likelihood of exploitation; it is not listed in CISA KEV.
Unauthenticated time-based blind SQL injection in FunnelKit's Funnel Builder for WooCommerce Checkout, affecting all versions up to and including 3.13.1.5, lets remote attackers inject arbitrary SQL through the 'opid' parameter and read sensitive data from the underlying WordPress database, including user credentials and plugin/optin tables. The flaw is fully pre-authentication (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) and needs no non-default configuration - only an active, internet-reachable site running the vulnerable plugin, since the optin DB class passes the parameter into a query without escaping or preparation. Impact is real but tempered: extraction is blind and timing-based, so it is slow and noisy rather than a bulk dump, EPSS is low at 0.38% (29th percentile), no CISA KEV listing and no public exploit code were identified at time of analysis, and the upstream fix is already committed in the plugin's trunk.
Unauthenticated remote attackers can write arbitrary JSON files into a WordPress site's publicly accessible uploads directory through the Hippoo Mobile App for WooCommerce plugin, in all versions up to and including 1.7.1. The flaw is a missing authorization check: the REST route /wp-json/hippoo/v1/wc/token/save_callback/{token_id} is registered with permission_callback => '__return_true', so no authentication is required and exploitation works against default configurations whenever the plugin is installed and active. Impact is integrity-only (C:N/I:L/A:N, CVSS 5.3) because the write primitive is limited to JSON content rather than executable code, so there is no direct remote code execution; EPSS is low at 0.28% (19th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Cross-site request forgery in the WordPress plugin Advanced Product Fields (Product Addons) for WooCommerce, affecting all versions up to and including 1.6.17, allows an unauthenticated attacker to duplicate and publish existing product field groups - including ones still in draft or pending status - by inducing a logged-in administrator to load an attacker-controlled page or link. The flaw is a missing nonce check in the plugin's 'maybe_duplicate' function (CWE-352); exploitation is remote and unauthenticated on the attacker's side but requires the victim administrator to interact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3), and impact is limited to integrity of field-group records since the attacker can replicate and publish existing groups but cannot inject arbitrary content. EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; this is a genuinely low-priority issue despite the network attack vector, with administrator user interaction as the primary limiting factor.
DOM-based cross-site scripting in Multi-Step Checkout for WooCommerce versions up to and including 2.33 allows low-privileged authenticated attackers to inject malicious scripts that execute in a victim's browser when they interact with the checkout page. The vulnerability requires user interaction and does not enable server-side code execution, and no public exploit code is identified at time of analysis; EPSS is low at 0.20%. This is a moderate risk that should be patched on a normal cycle rather than as an emergency.
Missing authorization in the MultiParcels Shipping For WooCommerce plugin (versions <= 1.30.12) allows an authenticated attacker with low privileges to perform unauthorized actions that are normally restricted, leading to limited integrity impact. This low-severity flaw (CVSS 4.3) requires the attacker to already possess a valid low-privilege account on the affected WordPress/WooCommerce site, and it does not permit data disclosure or denial of service. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile).
Unauthorized price alteration in the WPC Name Your Price for WooCommerce plugin (versions up to and including 2.1.9) lets unauthenticated attackers submit a custom price for products where the Name Your Price option was deliberately disabled, allowing purchases below the intended amount. The plugin fails to enforce that per-product disable setting on the server side, so the client-side control can be bypassed with a crafted request. The supplied CVSS 3.1 score is 7.5, but the independent assessment rates integrity impact as Low (CVSS 3.1 base 5.3, Medium); exploitation is deployment-specific and no public exploit identified at time of analysis.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Unauthorized order manipulation and information disclosure in the WooCommerce PayPal Payments WordPress plugin (versions through 4.0.1) allows remote unauthenticated attackers to abuse two WC-AJAX endpoints (ppc-create-order and ppc-get-order) that lack authorization checks. By chaining these endpoints, an attacker can create a PayPal order against any victim's WooCommerce order ID and then retrieve full PayPal order details including payer information and shipping data. No public exploit identified at time of analysis, but the plugin's broad e-commerce deployment and trivial attack complexity make this a credible target.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Unauthenticated information disclosure in the Track Orders for WooCommerce WordPress plugin before 1.2.7 lets anyone who already knows a customer's email address retrieve that customer's name, email, phone number, postal address and order history from the plugin's order-tracking lookup. The lookup returns billing details without ever verifying that the requester owns the referenced order, and because the CVSS vector confirms PR:N and UI:N, no account or interaction is needed - the only gating factor is prior possession of a valid customer email. No public exploit identified at time of analysis and no confirmed active exploitation (the flaw is not listed in CISA KEV), but CISA's SSVC assessment marks it automatable, and the vendor has released a fix in version 1.2.7.
Insufficient authorization in the Wallet System for WooCommerce WordPress plugin before 2.8.0 lets any authenticated user - a subscriber-level account is sufficient - file a withdrawal request against another user's wallet while freely choosing the amount and the payout destination. Because the plugin never checks that the wallet named in the submission belongs to the submitter, the attacker can also repeatedly lodge requests that indefinitely block the victim from making legitimate withdrawals of their own, producing an immediate denial-of-service effect even when no funds move. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; wallets with balances are the meaningful targets, and actual fund transfer typically still depends on an administrator approving the payout.
Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). Stores with open customer registration and the wallet-transfer feature enabled are directly exposed; no public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Information disclosure in the Wallet System for WooCommerce plugin before 2.8.0 allows any authenticated user on a WordPress site - the description states a subscriber-level account is sufficient - to generate and download a report containing every customer's wallet transaction history, including names, email addresses, user roles, transaction amounts, payment methods and dates. The report endpoint performs no capability check and instead trusts a token that the plugin renders on a front-end page, so any logged-in user can retrieve the token and then invoke the endpoint; no user interaction is required. The published base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while our assessment rates the confidentiality impact as High (C:H) because the exposure covers complete customer PII and the store's full financial transaction ledger. No public exploit code identified at time of analysis; patch available in 2.8.0.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin.
Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. There is no CISA KEV entry and no public exploit identified at time of analysis, so real-world priority is low-to-moderate; no EPSS score was supplied with the available intelligence.
Unauthenticated disclosure of other customers' uploaded files is possible through the File Uploads Addon for WooCommerce WordPress plugin in versions 1.7.2 through 1.7.5, because the plugin serves stored uploads without verifying that the requester is the customer who originally uploaded the file (CWE-639). An attacker who knows or guesses the exact file name of a previously uploaded file can retrieve it over the network with no account and no user interaction, as reflected by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9 Medium) - the High attack complexity stems entirely from the file-name discovery prerequisite, so real-world difficulty hinges on whether the plugin generates guessable or sequential names versus long random tokens. There is no public exploit identified at time of analysis, and the vendor has released a fix in 1.7.6.
Unauthenticated retrieval of customer-uploaded files is possible in the File Uploads Addon for WooCommerce WordPress plugin (versions 1.7.2 through 1.7.6), which stores customer submissions in a publicly web-accessible uploads directory while the access restriction it generates fails to actually block direct requests; an attacker who knows or can guess a file's name can fetch it straight from the web root, bypassing the plugin's authenticated download mechanism. The issue is a broken access control / insecure direct object reference problem (CWE-284) rather than a true authentication bypass, and only confidentiality of already-uploaded files is affected - no integrity or availability impact. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), the attack is unauthenticated and needs no user interaction, but the High attack-complexity component reflects that the attacker must correctly guess or otherwise learn the target filename; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Arbitrary modification of shipping information on WooCommerce orders is possible in the Razorpay for WooCommerce plugin before 4.8.8, allowing unauthenticated attackers to alter shipping details on orders they do not own. The flaw is a missing authorization check (CWE-639) on a REST API route used during checkout; publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile), indicating low predicted exploitation likelihood, and the vendor has released a patch in version 4.8.8.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.
Unauthenticated attackers can manipulate gift-card amounts in WebToffee Gift Cards for WooCommerce before 1.3.1 to bypass configured denominations and reduce or eliminate order totals, obtaining products without full payment. Publicly available exploit code exists, and the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms remote, unauthenticated, no-user-interaction exploitation with low integrity impact only. The affected component requires WordPress with the vulnerable plugin and WooCommerce gift-card purchasing enabled; no server or data compromise is involved.
Stored cross-site scripting in the Tabs Responsive WordPress plugin (through version 2.5) allows an authenticated shop manager holding product-tab editing capability to persist JavaScript inside a WooCommerce product tab, which then executes in the browser of any user who views that product page, including an administrator. Exploitation depends on a pre-existing WooCommerce installation, the attacker already possessing a shop manager or higher account, and victim interaction (the malicious tab must be rendered by another user), making this a privileged-insider or compromised-account scenario rather than anonymous remote access (CVSS vector PR:H/UI:R). No public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) status, and no vendor-released patch version is identified in the available data; the assessed impact is limited confidentiality and integrity loss within a changed scope (S:C/C:L/I:L/A:N).
Unauthorized affiliate action execution is possible in AFFI - Affiliate Marketing for WooCommerce through version 1.0.9 because an access-control check is missing, allowing unauthenticated remote attackers to perform a low-integrity action per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No public exploit code or CISA KEV entry was identified at time of analysis, so this is assessed as a modest-severity, integrity-only issue rather than an actively exploited urgent threat. The practical risk is abuse of the plugin's affiliate functionality on sites running the affected version.
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.
Cross-site request forgery (CSRF) in Razorpay Payment Links for WooCommerce versions 2.1.5 and earlier allows unauthenticated attackers to perform state-changing actions under an authenticated victim's session. Exploitation requires the victim to visit a malicious page or click a crafted link while logged into the WordPress site (UI:R), and the attack's success depends on the victim's privileges and the absence of CSRF mitigations like nonces or SameSite cookies. No public exploit code or active exploitation has been identified, and the moderate CVSS score of 5.4 reflects low integrity and availability impact with no confidentiality impact.
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
Unauthenticated remote attackers can mark pending WooCommerce orders as paid without completing payment by abusing the SUMIT Payment Gateway for WooCommerce plugin before version 4.0.0, which accepts payment notifications without validating them against the SUMIT payment provider. The vulnerability is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) and is confined to falsifying order payment status, i.e. financial fraud rather than site compromise; publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV). Risk is bounded mainly by the niche adoption of this specific gateway and by the fact that the integrity impact is limited to order state.
Unauthenticated attackers can view other customers' order details in NP Quote Request for WooCommerce versions 2.0 through 2.4.15 by supplying a valid order key, because the plugin fails to verify order ownership before rendering order details. Exploitation requires knowledge of a specific victim's order key (a pseudo-random token), which is the primary limiting factor and the reason for the high attack complexity (AC:H) in the CVSS vector; no authentication or user interaction is needed. This is a low-severity confidentiality flaw, and no public exploit code has been identified at time of analysis. The vendor has released version 2.4.16 to address the issue.
Missing authorization in the Points and Rewards for WooCommerce WordPress plugin before 2.10.4 allows an authenticated user holding only a Subscriber-level account to call the Win Wheel claim handler and credit their own account with an arbitrary, unlimited number of loyalty points; if the companion wallet plugin (same version line) is active, the fraudulently credited balance also extends to wallet funds. The flaw is remote and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N per independent assessment - note this rates integrity impact as High, above the 4.3 base score published with the CVE), and the only practical prerequisite is that the store has enabled the Win Wheel reward feature and permits open customer registration, which is typical for WooCommerce storefronts. Impact is integrity-only - loyalty point and wallet-balance fraud rather than site compromise or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor-released patch (2.10.4) is available.
Broken access control in the WC Fields Factory WordPress plugin before 4.1.11 allows an authenticated user holding Contributor-level privileges or higher to invoke the plugin's post-cloning action without any capability check or nonce verification. By doing so, the attacker can duplicate posts of any type or status - including private posts and drafts belonging to other users - and then read the resulting copy, effectively bypassing WordPress's normal content-access controls. The impact is limited to unauthorized read access to duplicated content rather than modification, deletion, or code execution, which keeps this a genuinely low-severity, low-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Information disclosure in the Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 through 5.7.2) lets authenticated users holding Contributor-level privileges or above enumerate and read other authors' private, draft, and trashed events, along with event detail that the normal listing view withholds. The flaw is an authorization/access-control defect (CWE-284) rather than remote code execution: it is read-only, requires an existing WordPress account with at least Contributor rights, and cannot be triggered by an anonymous visitor, so the practical risk depends heavily on how readily a site hands out contributor accounts. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has released a fix in version 5.7.3; our independent assessment rates this a genuinely low-priority issue and scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (the NVD vector's PR:H overstates the privilege bar relative to the contributor-level access described).
Unauthenticated information disclosure in the Product Badge, Label, Countdown Timer for WooCommerce plugin (versions 7.0.0 up to but not including 7.5.2) lets remote attackers retrieve the title, description, and price of products that are in draft, pending, or private status. The plugin returns product details without first verifying that the product is published, so any user who can reach the affected front-end functionality can enumerate unpublished catalog content; no authentication, user interaction, or special configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to confidentiality of product metadata - there is no write, code execution, or availability effect - and the practical exposure depends on whether the store actually holds sensitive unpublished products; no public exploit identified at time of analysis. A vendor patch is available in 7.5.2.
Authenticated users holding only contributor-level access on WordPress sites running the Paymob for WooCommerce plugin before 4.1.14 can delete, wipe, or modify the plugin's payment-gateway configuration, including stored Paymob payment credentials, because several admin-AJAX handlers omit a capability check (CWE-862 missing authorization). The affected site must have the plugin installed and active, and the attacker must first obtain a low-privilege account - via open registration or a compromised contributor user - after which no administrator interaction and no non-default configuration are required, yielding low confidentiality and availability impact but high integrity impact on the gateway configuration. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 4.1.14; despite the 'Authentication Bypass' tag applied by the reporter, the assessed nature of the flaw is an authorization gap, not a credential-free bypass.
Unauthenticated remote attackers can write forged card-token records into arbitrary user accounts and enumerate registered users on WordPress sites running the Paymob for WooCommerce plugin before version 4.1.14, because the card-token branch of the plugin's payment webhook never validates the request signature. Exploitation requires only that the site runs the affected plugin with its webhook endpoint reachable - no credentials, user interaction, or non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, NVD 5.3) - and impact is limited to unauthorized data writes and account enumeration rather than account takeover or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch (4.1.14) is available, so exposure is bounded by Paymob's regional (MENA) deployment footprint.
Missing authorization checks in the Social Commerce for WooCommerce WordPress plugin (versions through 2.5.4) leave several of its REST API endpoints reachable by unauthenticated users, allowing anyone who can reach the site to overwrite plugin configuration and product-synchronisation state. The flaw is CWE-862 (missing authorization) with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning exploitation requires no credentials or user interaction but is limited to partial integrity impact - no data disclosure and no denial of service. Exposure is restricted to WordPress sites running this specific niche plugin at a vulnerable version, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can capture another buyer's approved-but-uncaptured PayPal payment against a WooCommerce order of their own choosing in Payment Plugins for PayPal WooCommerce versions before 2.0.27. The plugin fails to confirm that the PayPal order supplied in a payment request actually belongs to the WooCommerce order being paid unless that PayPal order is already completed, so any store running the vulnerable plugin with the PayPal gateway active is exposed. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but gated by a timing prerequisite - a different buyer must have an approved, not-yet-captured PayPal order whose identifier the attacker can supply - yielding a conditional integrity impact (C:L/I:H/A:N, CVSS 6.5) rather than a high-urgency emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV). A vendor patch is available in 2.0.27.
WooCommerce PayPal Gateway before 9.2.1 allows unauthenticated attackers to mark their own orders as paid without paying the store by submitting a genuine PayPal transaction generated from a sandbox account they control. The plugin fails to verify that the payment notification came from the store's configured live payment environment and was paid to the store's merchant account, a business-logic flaw rated CVSS 5.3 (integrity impact only). No public exploit code or active exploitation has been identified, and stores running 9.2.1 or later are unaffected.
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.
Authorization bypass in the Datalogics Ecommerce Delivery plugin for WordPress (all versions up to and including 2.6.65) lets any authenticated subscriber-level user exercise store-owner functions that should require higher privileges: creating and cancelling real shipping orders through the external logistics provider using the store's stored API token, rewriting arbitrary WooCommerce order post meta on any order, overwriting the plugin's own stored API token, and firing shipping-notification emails to customers. The issue is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the impact is integrity-only and limited to business-logic abuse rather than code execution. It requires only a low-privilege WordPress account plus a site running WooCommerce with the plugin and a configured logistics API token; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), though stores with open subscriber registration carry the greatest exposure.
Authenticated users with subscriber-level access or higher can alter Empik-specific WooCommerce product metadata on any store running the Empik for WooCommerce plugin up to and including version 1.5.1, because the plugin's CSV import and product/offer import handlers execute without verifying user capabilities. The missing authorization check (CWE-862) allows modification of the _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and export/offer flag fields on arbitrary products, producing an integrity-only impact scored at CVSS 4.3 with no confidentiality or availability effect and no code execution. No public exploit has been identified at the time of analysis; exposure is greatest on sites with open user registration, where any self-registered subscriber account is sufficient to reach the vulnerable endpoints.
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Missing authorization checks in the PDF Builder for WooCommerce WordPress plugin (all versions up to and including 2.0.11) allow any authenticated user holding Subscriber-level access or above to read invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying attacker-chosen OrderNumber and InvoiceId values together with a garbage nonce. The prerequisite authentication is trivially met on stores that allow open customer registration, but the disclosure is confined to invoice metadata rather than full order or customer records, so impact is limited to low confidentiality (CVSS 4.3). No public exploit code has been identified at time of analysis, and an upstream fix is available via plugin repository changeset 3626297.
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.
Unauthenticated attackers can add arbitrary products to a WooCommerce cart and check out at the discounted price tied to a Frequently Bought Together campaign in the UpsellWP WordPress plugin (versions 1.4.4 through before 2.2.10), because the plugin never verifies that cart items actually belong to the campaign being applied. The flaw is a business-logic validation gap rather than a data-exposure or availability issue: the manipulation is limited to an integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), with real-world loss scaling to the size of the configured discount and the value of the goods sold. Publicly available exploit code exists, but there is no indication of confirmed active exploitation; the vendor has released a fix, so upgrading to 2.2.10 removes the issue.
Authenticated users, including a self-registered WooCommerce customer, can delete arbitrary media attachments belonging to other users on WordPress sites running the Checkout Field Manager (Checkout Manager) for WooCommerce plugin before version 7.9.7, because the plugin fails to verify attachment ownership before performing the delete. The flaw is a broken-authorization (CWE-862/IDOR) issue rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning the impact is limited to integrity of file data with no confidentiality loss or code execution, but any low-privilege account - not necessarily an administrator - is sufficient. Publicly available exploit code exists per the WPScan disclosure, and there is no confirmed active exploitation (CISA KEV); remediation is a straightforward upgrade to 7.9.7 or later.
Arbitrary media-attachment deletion in the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before version 7.9.7 lets any authenticated user - including a self-registered customer account - delete media attachments that belong to other users, because the plugin fails to verify ownership of the attachment before acting on it. The flaw is a classic IDOR (CWE-639) with limited impact: integrity only, no data disclosure, no remote code execution, and no site-wide outage, which is why the CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (published via WPScan), and no CISA KEV entry indicates confirmed active exploitation, but the low bar for exploitation on WooCommerce stores with default open customer registration means the practical risk is higher than the numeric score alone suggests.
Forged payment notifications against the Robokassa payment gateway for WooCommerce (all versions before 1.8.9) let unauthenticated remote attackers mark arbitrary WooCommerce orders as paid or on-hold without a real payment or a valid Robokassa signature. The flaw is only reachable when the plugin's non-default deferred-payment feature is explicitly enabled; default installations do not expose the vulnerable notification path. Despite a low CVSS base score of 3.7 and impact confined to order-status manipulation rather than data theft or site takeover, publicly available exploit code exists and the total absence of a signature check makes the callback path straightforward to abuse on affected configurations.
Authenticated users with only Subscriber-level WordPress accounts can rename arbitrary posts, pages, and WooCommerce products on sites running the Active Woot Products Tables for WooCommerce plugin before version 2.1.3, because several plugin AJAX actions perform neither capability nor CSRF nonce checks. Exploitation requires a valid low-privilege account (self-registration enabled or credentials otherwise obtained) and, for the CSRF route, a logged-in victim tricked into visiting a crafted page. Publicly available exploit code exists and the vendor has released a fix in 2.1.3; impact is limited to title/integrity tampering with no data disclosure, deletion, or code execution, so this is a low-to-moderate real-world risk.
Unauthenticated information disclosure in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 allows remote attackers to dump WooCommerce order details and customer contact information, target a specific order by identifier, and search the store's entire order set by customer name or email address. Exploitation requires only that the plugin be installed and active on a WordPress site with WooCommerce data present - no credentials, roles, or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - and publicly available exploit code exists alongside a WPScan-published proof of concept. Impact is limited to confidentiality (C:L) with no write or code-execution capability, and EPSS places exploitation likelihood at roughly 0.22% (13th percentile), making this a moderate-priority exposure whose real risk scales with the sensitivity and volume of customer records the store holds.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated order sabotage in WooCommerce Stripe Payment Gateway (all versions ≤10.7.0) allows any remote attacker to force pending WooCommerce orders into a 'failed' state without owning or authenticating against those orders. The root cause is a missing authorization check on the `ajax_pay_for_order()` function: the only gate is a nonce that is publicly available on any page where Express Checkout is enabled, providing no actual access control. Exploitation is trivially automatable via sequential order ID enumeration, enabling targeted disruption of an entire store's pending transactions. No public exploit has been identified at time of analysis, and no KEV listing exists, but the attack complexity is effectively zero for stores with Express Checkout active.
Unauthenticated attackers can modify WooPayments plugin settings through a missing capability check in the 'save_upe_appearance_ajax' AJAX function, affecting all versions up to and including 10.5.1. This allows remote attackers to alter payment appearance configurations without authentication, potentially disrupting payment processing or customer experience. No public exploit code or active exploitation has been identified at time of analysis.
ShopMagic for WooCommerce through version 4.7.2 fails to enforce an authorization (capability) check on at least one plugin action, so an unauthenticated remote attacker can invoke functionality that should be restricted to privileged users. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication, no user interaction and no special timing are needed, but the achievable impact is limited to a low-integrity state change - no data disclosure, no denial of service, and no server-side code execution is implied by the assessed vector. EPSS is only 0.22% (11th percentile) and there is no CISA KEV entry, and no public exploit identified at time of analysis, so this is a high-reach, low-impact misconfiguration rather than an emergency-priority issue; exploitation still requires the plugin to be installed and active on a reachable WordPress site.
DOM-based cross-site scripting in the Vidish Combo Offers WooCommerce plugin (woo-combo-offers) version 4.2 and earlier allows an authenticated attacker holding at least low-level privileges on a WordPress/WooCommerce site to inject script that executes in a victim's browser when the victim loads or interacts with the tainted page element. Exploitation requires both valid credentials (PR:L per the CVSS vector) and victim interaction (UI:R), so it is not reachable by a fully unauthenticated, zero-interaction attacker; the network attack vector and scope change (S:C) keep the score at 6.5, but the practical risk is low. No public exploit code has been identified and the CVE is not in CISA KEV, with an EPSS score of only 0.16% (5th percentile).
Stored cross-site scripting in the YITH WooCommerce Quick View WordPress plugin (all versions up to and including 2.7.0) allows an authenticated attacker holding contributor-level privileges or above to inject arbitrary JavaScript into pages through unsanitized attributes passed to the plugin's yith_quick_view shortcode. The payload is persisted in post/page content and executes in the browser of any visitor who later opens the affected page - most dangerously a higher-privileged user such as an administrator, which could lead to session or privilege abuse on the site. Severity is moderate (CVSS 6.4, scope changed) rather than critical: exploitation requires an existing contributor account, EPSS is only 0.29% (20th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can create arbitrary WooCommerce products on WordPress sites running the Eyewear Prescription Form plugin up to and including version 6.0.1, because the SubmitCatProductRequest AJAX action lacks any authorization or nonce checks. The flaw is rated CVSS 5.3 with an EPSS score of 0.27% (18th percentile); no public exploit has been identified at time of analysis, and exploitation requires WooCommerce to be installed alongside the plugin. Impact is limited to integrity (product creation) with no confidentiality or availability effect.
Missing authorization in the WordPress plugin Eyewear prescription form (all versions up to and including 6.0.1) lets unauthenticated remote attackers delete arbitrary WooCommerce product categories - including every child category beneath them - by invoking the plugin's RemoveItems AJAX action with attacker-controlled category IDs in the 'catIds' parameter. The CVSS vector (PR:N, UI:N) confirms exploitation requires no authentication and no user interaction, though impact is limited to integrity loss (I:L) on sites that both run WooCommerce and have the vulnerable plugin active. No public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the destructive-only, no-code-execution nature of the flaw.
Time-based blind SQL injection in the Payamito SMS WooCommerce plugin for WordPress (versions up to and including 1.3.5) allows unauthenticated attackers to extract sensitive database information via the 'columns' parameter. The vulnerability requires the plugin to be installed and active alongside WooCommerce, and exploitation is noisy due to the request-heavy nature of time-based blind extraction. No public exploit code was identified at time of analysis, and the EPSS score is 0.45% (37th percentile), indicating low likelihood of exploitation; it is not listed in CISA KEV.
Unauthenticated time-based blind SQL injection in FunnelKit's Funnel Builder for WooCommerce Checkout, affecting all versions up to and including 3.13.1.5, lets remote attackers inject arbitrary SQL through the 'opid' parameter and read sensitive data from the underlying WordPress database, including user credentials and plugin/optin tables. The flaw is fully pre-authentication (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) and needs no non-default configuration - only an active, internet-reachable site running the vulnerable plugin, since the optin DB class passes the parameter into a query without escaping or preparation. Impact is real but tempered: extraction is blind and timing-based, so it is slow and noisy rather than a bulk dump, EPSS is low at 0.38% (29th percentile), no CISA KEV listing and no public exploit code were identified at time of analysis, and the upstream fix is already committed in the plugin's trunk.
Unauthenticated remote attackers can write arbitrary JSON files into a WordPress site's publicly accessible uploads directory through the Hippoo Mobile App for WooCommerce plugin, in all versions up to and including 1.7.1. The flaw is a missing authorization check: the REST route /wp-json/hippoo/v1/wc/token/save_callback/{token_id} is registered with permission_callback => '__return_true', so no authentication is required and exploitation works against default configurations whenever the plugin is installed and active. Impact is integrity-only (C:N/I:L/A:N, CVSS 5.3) because the write primitive is limited to JSON content rather than executable code, so there is no direct remote code execution; EPSS is low at 0.28% (19th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Cross-site request forgery in the WordPress plugin Advanced Product Fields (Product Addons) for WooCommerce, affecting all versions up to and including 1.6.17, allows an unauthenticated attacker to duplicate and publish existing product field groups - including ones still in draft or pending status - by inducing a logged-in administrator to load an attacker-controlled page or link. The flaw is a missing nonce check in the plugin's 'maybe_duplicate' function (CWE-352); exploitation is remote and unauthenticated on the attacker's side but requires the victim administrator to interact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3), and impact is limited to integrity of field-group records since the attacker can replicate and publish existing groups but cannot inject arbitrary content. EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; this is a genuinely low-priority issue despite the network attack vector, with administrator user interaction as the primary limiting factor.
DOM-based cross-site scripting in Multi-Step Checkout for WooCommerce versions up to and including 2.33 allows low-privileged authenticated attackers to inject malicious scripts that execute in a victim's browser when they interact with the checkout page. The vulnerability requires user interaction and does not enable server-side code execution, and no public exploit code is identified at time of analysis; EPSS is low at 0.20%. This is a moderate risk that should be patched on a normal cycle rather than as an emergency.
Missing authorization in the MultiParcels Shipping For WooCommerce plugin (versions <= 1.30.12) allows an authenticated attacker with low privileges to perform unauthorized actions that are normally restricted, leading to limited integrity impact. This low-severity flaw (CVSS 4.3) requires the attacker to already possess a valid low-privilege account on the affected WordPress/WooCommerce site, and it does not permit data disclosure or denial of service. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile).
Unauthorized price alteration in the WPC Name Your Price for WooCommerce plugin (versions up to and including 2.1.9) lets unauthenticated attackers submit a custom price for products where the Name Your Price option was deliberately disabled, allowing purchases below the intended amount. The plugin fails to enforce that per-product disable setting on the server side, so the client-side control can be bypassed with a crafted request. The supplied CVSS 3.1 score is 7.5, but the independent assessment rates integrity impact as Low (CVSS 3.1 base 5.3, Medium); exploitation is deployment-specific and no public exploit identified at time of analysis.