CVE-2025-13029: 
WordPress vulnerability analysis and mitigation

CVE-2025-13029 is an unauthenticated arbitrary user deletion vulnerability in the Knowband Mobile App Builder for WooCommerce WordPress plugin. The flaw affects all versions before 3.0.0 and allows unauthenticated attackers to delete any WordPress user — including administrators — via an unprotected REST API endpoint. It was publicly disclosed on December 10, 2025, by researcher Khaled Alenazi (Nxploited) and assigned a CVSS v3.1 base score of 7.5 (High) by CISA-ADP, while WPScan rates it 8.2 (High) (WPScan).

The root cause is a missing authorization check (CWE-862) on the plugin's REST API endpoint /wp-json/wmab/v2.0/appDeleteUser/, which accepts a POST request with a user email address and deletes the corresponding account without verifying the requester's identity or privileges. This falls under OWASP Top 10 A5: Broken Access Control. Exploitation requires only that the WooCommerce plugin is also active on the target site and that the attacker knows or can enumerate a valid user email address. A public proof-of-concept curl command was published alongside the disclosure (WPScan).

Successful exploitation allows any unauthenticated attacker to permanently delete arbitrary WordPress user accounts, including site administrators, resulting in a high integrity impact with no confidentiality or availability impact per the CVSS scoring. Deletion of administrator accounts could effectively lock legitimate owners out of their own sites, enabling site takeover if the attacker subsequently registers a new admin account or exploits other weaknesses. The impact is scoped to WordPress sites running both the vulnerable plugin and WooCommerce (WPScan, Feedly).

A public proof-of-concept is available via WPScan, consisting of a simple curl POST request requiring only a valid target email address — no authentication or special tooling is needed. The EPSS score is 0.022% (0.000220), indicating currently low predicted exploitation probability. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites running the Knowband Mobile App Builder for WooCommerce plugin (versions < 3.0.0) using tools like WPScan, Shodan, or by checking /wp-content/plugins/knowband-mobile-app-builder-for-woocommerce/ for plugin presence.
2. Confirm WooCommerce is active: Verify that WooCommerce is also installed and active on the target site, as the vulnerable endpoint requires it.
3. Enumerate a valid user email: Obtain a valid user email address (e.g., the admin email, which is sometimes exposed in WordPress feeds, author pages, or WooCommerce order confirmations).
4. Send the deletion request: Execute the following command, substituting the target email and domain:

curl -s -X POST "http://example.com/wp-json/wmab/v2.0/appDeleteUser/" -d "email=admin@example.com"

5. Achieve objective: The targeted user account is deleted without any authentication. Repeating this for all known admin accounts can result in complete loss of administrative access to the site (WPScan).

• Network: Unexpected POST requests to /wp-json/wmab/v2.0/appDeleteUser/ from external or unknown IP addresses in web server access logs.
• Logs: WordPress audit logs or server access logs showing repeated or anomalous calls to the appDeleteUser REST API endpoint, especially from unauthenticated sessions; sudden user deletion events in WordPress admin logs.
• Application: Unexpected disappearance of WordPress user accounts, particularly administrator accounts; WordPress admin dashboard showing reduced user count without corresponding admin action.

Update the Knowband Mobile App Builder for WooCommerce plugin to version 3.0.0 or later, which introduces proper authorization checks on the affected REST API endpoint. No configuration-based workaround is available short of deactivating or removing the plugin entirely until the update can be applied. Site administrators should also audit their WordPress user accounts after patching to verify no accounts were deleted prior to remediation (WPScan).

The vulnerability was reported by independent researcher Khaled Alenazi (Nxploited) and verified by WPScan. Brief social media mentions appeared on Mastodon and Bluesky via The Hacker Wire account shortly after disclosure. No major vendor statements or significant media coverage beyond standard vulnerability aggregator reporting have been identified.