PT-2025-40493 · Unknown+1 · Woocommerce+1

Johska · Published 2025-10-03 · Updated 2025-10-08 · CVE-2025-9286

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appy Pie Connect for WooCommerce versions up to and including 1.1.2

Description The Appy Pie Connect for WooCommerce plugin for WordPress is susceptible to a privilege escalation issue. A missing authorization check within the reset user password() REST handler allows unauthenticated attackers to reset the passwords of any user, including administrators. This can lead to complete administrative control of the WordPress site. The reset user password() function lacks proper authentication, enabling attackers to exploit this flaw with a single request.

Recommendations Update Appy Pie Connect for WooCommerce to a version later than 1.1.2.

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-9286

Affected Products

Appy Pie Connect For Woocommerce

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-9286 · Security Note
• https://twitter.com/0dayPublishing/status/1974076744500932863 · Twitter Post
• https://twitter.com/cracbot/status/1975878904658133097 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3385150 · Note
• https://wordpress.org/plugins/appy-pie-connect-for-woocommerce · Note
• https://twitter.com/CveFindCom/status/1974077695450354053 · Twitter Post
• https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php · Note