CVE-2025-11741: 
WordPress 脆弱性の分析と軽減

The WPC Smart Quick View for WooCommerce plugin for WordPress contains an Information Exposure vulnerability (CVE-2025-11741) affecting all versions up to and including 4.2.5. The vulnerability was discovered and disclosed on October 17, 2025 (NVD CVE).

The vulnerability exists in the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD CVE).

This vulnerability allows unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to. This could lead to the exposure of sensitive product information before it is intended to be publicly available (NVD CVE).

The vulnerability has been fixed in version 4.2.6 of the WPC Smart Quick View for WooCommerce plugin. Users are advised to update to this version immediately. The update includes security fixes and code optimizations to prevent unauthorized access to protected product information (WordPress Plugin).