PT-2025-46247 · WordPress · Easycommerce

Kenneth Dunn · Published 2025-11-11 · Updated 2025-11-16 · CVE-2025-11457

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin versions 0.9.0-beta2 through 1.5.0

Description The EasyCommerce plugin for WordPress has a flaw where the /easycommerce/v1/orders API endpoint does not adequately limit user role selection during registration. This allows unauthenticated attackers to obtain administrator-level access to a vulnerable website. The POST request to this endpoint enables attackers to register with administrative privileges without authentication.

Recommendations Versions 0.9.0-beta2 through 1.5.0 should be updated to a newer, secure version.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-11457

Affected Products

Easycommerce

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11457 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7ebe84ba-abc1-410c-b315-118746ff235a?source=cve · Note
• https://wordpress.org/plugins/easycommerce · Note
• https://twitter.com/CVEnew/status/1988095319935005157 · Twitter Post
• https://twitter.com/0dayPublishing/status/1988093053630882264 · Twitter Post
• https://t.me/cveNotify/142365 · Telegram Post
• https://twitter.com/MNovofastovsky/status/1990056122569420876 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3392029/easycommerce/trunk/app/Abstracts/User.php · Note
• https://twitter.com/gothburz/status/1989106393043857697 · Twitter Post