PT-2025-36174 · WordPress · Bonus For Woo

Martino Spagnuolo · CVE-2025-58835 · Published 2025-09-05 · Updated 2025-09-05

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bonus for Woo versions n/a through 7.4.1

Description An improper validation of the specified quantity in input exists in Bonus for Woo, potentially allowing access to functionality not properly constrained by Access Control Lists (ACLs).

Recommendations Update Bonus for Woo to a version later than 7.4.1.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2025-58835

Affected Products

Bonus For Woo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-58835 · Security Note
• https://patchstack.com/database/wordpress/plugin/bonus-for-woo/vulnerability/wordpress-bonus-for-woo-plugin-7-4-1-other-vulnerability-type-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1964008910429315400 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/bonus-for-woo/vulnerability/wordpress-bonus-for-woo-plugin-7-4-1-other-vulnerability-type-vulnerability?_s_id=cve · Note