PT-2026-29472 · Automattic+1 · Woocommerce+1

Khaled Alenazi · CVE-2025-15484 · Published 2026-04-01 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Order Notification for WooCommerce WordPress plugin versions prior to 3.6.3

Description The Order Notification for WooCommerce WordPress plugin before version 3.6.3 bypasses WooCommerce's permission checks, granting full access to all unauthenticated requests. This allows complete read and write access to store resources, including products, coupons, and customer data.

Recommendations Update the Order Notification for WooCommerce WordPress plugin to version 3.6.3 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15484

Affected Products

Order Notification For Woocommerce

Woocommerce

References · 5

• 🔥 https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15484 · Security Note
• https://twitter.com/TheHackerWire/status/2039354891995607125 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2044757335415951658 · Twitter Post
• https://twitter.com/CVEnew/status/2039279652687282416 · Twitter Post