CVE-2025-12955: 
WordPress vulnerability analysis and mitigation

CVE-2025-12955 is a Missing Authorization vulnerability in the "Live sales notification for WooCommerce" WordPress plugin (by rajeshsingh520) that allows unauthenticated attackers to extract sensitive customer order data. All versions up to and including 2.3.39 are affected. The vulnerability was published on November 18, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the plugin's getOrders function does not perform proper authorization or capability checks before returning order data, even when the plugin is configured to display recent order information publicly. Because no authentication or privilege verification is enforced, any network-accessible attacker can call this function directly — typically via a WordPress AJAX or REST endpoint — and receive a response containing customer data. No special preconditions beyond the plugin being installed and configured to show recent orders are required (Wordfence, ZeroPath).

Successful exploitation allows unauthenticated remote attackers to extract sensitive customer information including buyer first names, city, state, country, purchase timestamps, and product details from WooCommerce stores. This represents a high confidentiality impact, exposing personally identifiable information (PII) of customers at scale. There is no integrity or availability impact, but the exposed data could facilitate targeted phishing, social engineering, or regulatory compliance violations (e.g., GDPR) (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.044% (0.000440), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated, network-accessible nature of the flaw (no privileges or user interaction required) makes it trivially exploitable if discovered (Wordfence, ZeroPath).

1. Reconnaissance: Identify WordPress sites running the "Live sales notification for WooCommerce" plugin (version ≤ 2.3.39) using tools like WPScan, Shodan, or by checking /wp-content/plugins/live-sales-notifications-for-woocommerce/ for plugin presence.
2. Identify the vulnerable endpoint: Locate the WordPress AJAX action or REST route registered by the plugin's getOrders function (typically accessible via wp-admin/admin-ajax.php with the relevant action parameter, or a REST API endpoint).
3. Send unauthenticated request: Craft an HTTP GET or POST request to the identified endpoint without any authentication cookies or tokens, e.g.:

   POST /wp-admin/admin-ajax.php
   action=<plugin_getOrders_action>

4. Extract customer data: Parse the JSON response, which will contain buyer first names, city, state, country, purchase time/date, and product details for recent orders.
5. Repeat or automate: Iterate requests to collect bulk customer PII for downstream abuse such as phishing or data brokering (ZeroPath, Wordfence).

• Network: Repeated unauthenticated POST or GET requests to /wp-admin/admin-ajax.php with the plugin's getOrders action parameter from a single or rotating IP address; unusual volume of requests to this endpoint from non-logged-in sessions.
• Logs: WordPress access logs showing high-frequency requests to admin-ajax.php without session cookies or nonce tokens, particularly from automated user-agent strings or unfamiliar IP ranges.
• Application: JSON responses containing customer order data returned to unauthenticated requestors visible in server-side debug or audit logs if enabled.

Update the "Live sales notification for WooCommerce" plugin to version 2.3.40 or later, which introduces proper authorization and capability checks in the getOrders function (Wordfence, WordPress Changeset). If immediate patching is not possible, consider disabling the plugin or disabling the "display recent order information" feature until the update can be applied. Web application firewall (WAF) rules blocking unauthenticated access to the plugin's AJAX endpoints can serve as a temporary mitigation.

Sucuri included CVE-2025-12955 in their November 2025 vulnerability patch roundup, highlighting it as a notable WordPress plugin issue requiring prompt attention (Sucuri Blog). RedPacket Security flagged the CVE via social media shortly after disclosure, and the vulnerability was noted across aggregator platforms including VulDB, Vulners, and CVEFeed. Community reaction has been moderate, consistent with a high-severity but non-critical data exposure flaw in a niche plugin.