CVE-2025-13666: 
WordPress vulnerability analysis and mitigation

CVE-2025-13666 is a Missing Authorization vulnerability in the Helloprint plugin for WordPress, affecting versions up to and including 2.1.2. The flaw allows unauthenticated attackers to arbitrarily modify WooCommerce order statuses by sending requests to a publicly exposed REST API endpoint without any authentication or authorization checks. It was published on December 6, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The Helloprint plugin registers a public REST API endpoint — /wp-json/helloprint/v1/complete_order_from_helloprint_callback — without implementing any authorization checks to verify the authenticity or origin of incoming requests. An unauthenticated attacker only needs to supply a valid WooCommerce order reference ID to trigger order status changes. The vulnerable code path is visible in the plugin's OrderController.php at line 48 (Wordfence, WordPress Trac).

Successful exploitation allows any unauthenticated, network-accessible attacker to manipulate WooCommerce order statuses on affected WordPress sites, directly compromising transaction integrity. This could enable fraud scenarios such as marking unpaid or unfulfilled orders as complete, disrupting order fulfillment workflows, or causing financial losses for merchants. There is no confidentiality or availability impact, but the integrity impact on e-commerce operations can be significant (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13666. The EPSS score is approximately 0.045% (0.000450), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it straightforward to exploit if a valid order reference ID can be obtained or guessed (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Helloprint WooCommerce plugin (version ≤ 2.1.2) by checking for the plugin's presence via publicly accessible WordPress plugin paths or HTTP response headers.
2. Obtain a valid order reference ID: Acquire a legitimate WooCommerce order reference ID — this could be obtained through a prior purchase, social engineering, or by enumerating predictable order IDs if the store uses sequential identifiers.
3. Craft the malicious request: Send an unauthenticated HTTP POST (or GET, depending on endpoint configuration) request to /wp-json/helloprint/v1/complete_order_from_helloprint_callback with the valid order reference ID as a parameter.
4. Trigger order status modification: The endpoint processes the request without any authorization check, updating the targeted WooCommerce order status (e.g., marking it as "complete") as if the callback originated from Helloprint's legitimate service.
5. Achieve objective: The attacker can fraudulently mark orders as fulfilled, potentially receiving goods or services without payment, or disrupt legitimate order processing (Wordfence, WordPress Trac).

• Network: Unexpected or repeated HTTP requests to /wp-json/helloprint/v1/complete_order_from_helloprint_callback from IP addresses not associated with Helloprint's legitimate service infrastructure.
• Logs: WordPress or web server access logs showing unauthenticated POST/GET requests to the above endpoint, especially from unfamiliar or foreign IP addresses.
• Application: WooCommerce order status changes to "complete" or similar states that do not correspond to legitimate fulfillment events or payment confirmations, particularly for orders that were not yet paid or shipped.

Users should update the Helloprint WordPress plugin to version 2.1.3 or later, which addresses the missing authorization check on the REST API callback endpoint. Until an update can be applied, site administrators may consider temporarily disabling the Helloprint plugin or restricting access to the /wp-json/helloprint/v1/ REST API namespace via web server rules (e.g., .htaccess or nginx configuration) to trusted Helloprint IP ranges. Monitoring WooCommerce order status change logs for anomalous activity is also recommended as a detective control (Wordfence, ENISA EUVD).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 6, 2025. Coverage has been limited to automated vulnerability tracking platforms and aggregators such as VulnDB, Patchstack, and ENISA's EUVD. No notable researcher commentary or significant social media discussion has been identified beyond standard CVE broadcast posts (Wordfence).