PT-2025-26365 · WordPress · Woocommerce Manager

Mika · Published 2025-06-20 · Updated 2025-06-20 · CVE-2025-50008

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: WooCommerce Manager - Customize and Control Cart page, Add to Cart button, Checkout fields easily versions 1.2.4.5 and earlier

Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation due to incorrectly configured access control security levels. This vulnerability affects the WooCommerce Manager plugin, specifically the customization and control of the cart page, add to cart button, and checkout fields.

Recommendations: For versions 1.2.4.5 and earlier, update to a version that includes a fix for the Missing Authorization vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-50008

Affected Products

Woocommerce Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-50008 · Security Note
• https://twitter.com/CVEnew/status/1936097356954714444 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/innovs-woo-manager/vulnerability/wordpress-woocommerce-manager-customize-and-control-cart-page-add-to-cart-button-checkout-fields-easily-plugin-1-2-4-5-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/innovs-woo-manager/vulnerability/wordpress-woocommerce-manager-customize-and-control-cart-page-add-to-cart-button-checkout-fields-easily-plugin-1-2-4-5-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1936103920385831336 · Twitter Post