PT-2025-47284 · Unknown+1 · Woocommerce+1

Athiwat Tiprasaharn · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12955

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Live sales notification for WooCommerce plugin for WordPress versions prior to 2.3.39

Description The Live sales notification for WooCommerce plugin for WordPress is affected by a missing authorization issue. The getOrders function does not have proper authorization and capability checks when configured to display recent order information. This allows unauthenticated attackers to extract sensitive customer information, including buyer first names, city, state, country, purchase time and date, and product details.

Recommendations Update to a version newer than 2.3.39.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12955

Affected Products

Live Sales Notification For Woocommerce

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12955 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394241%40live-sales-notifications-for-woocommerce&old=3389540%40live-sales-notifications-for-woocommerce&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/37591 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990825847029141742 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1990731580579398107 · Twitter Post
• https://twitter.com/CVEnew/status/1990717537697284152 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=cve · Note
• https://t.me/cveNotify/143175 · Telegram Post