PT-2025-44237 · WordPress · Woocommerce

Osama-Hamad · Published 2025-10-29 · Updated 2025-10-29 · CVE-2023-7320

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce versions prior to 7.8.3

Description The WooCommerce plugin for WordPress exhibits a sensitive information exposure issue due to improper CORS (Cross-Origin Resource Sharing) handling on the Store API’s REST endpoints. This allows direct external access from any origin, potentially enabling unauthenticated attackers to extract sensitive user information, including PII (Personally Identifiable Information). The affected API endpoints are susceptible to unauthorized access because of the misconfigured CORS policy.

Recommendations Update to WooCommerce version 7.8.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-7320

Affected Products

Woocommerce

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-7320 · Security Note
• https://wpscan.com/vulnerability/d1cec296-b5df-4cea-8c0d-d03a975cb6af · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2939652@woocommerce/trunk&old=2933569@woocommerce/trunk&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/140777 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7b2d1879-c337-41c9-9f47-f9c2fe8e5928?source=cve · Note