CVE-2025-15484: 
WordPress vulnerability analysis and mitigation

CVE-2025-15484 is an unauthenticated WooCommerce REST permission bypass vulnerability in the "Order Notification for WooCommerce" WordPress plugin. The plugin overrides WooCommerce's built-in permission checks, granting full read/write access to all unauthenticated HTTP requests against the WooCommerce REST API. All plugin versions before 3.6.3 are affected. The vulnerability was publicly disclosed on March 11, 2026, and assigned a CVSS v3.1 base score of 9.1 (Critical) (WPScan, Github Advisory).

The root cause is classified as CWE-287 (Improper Authentication): the plugin hooks into WooCommerce's REST API permission callback mechanism and unconditionally returns true (or equivalent), bypassing all authentication and authorization checks that WooCommerce would otherwise enforce. This allows any unauthenticated network request to the WooCommerce REST API endpoints (e.g., /wp-json/wc/v3/products, /wp-json/wc/v3/coupons, /wp-json/wc/v3/customers) to succeed with full privileges. No credentials, tokens, or prior access are required — the attack vector is purely network-based with low complexity. A public proof-of-concept using simple curl commands was published alongside the advisory (WPScan).

Successful exploitation grants unauthenticated attackers complete read and write access to all WooCommerce store resources, including products, coupons, and customer records. Attackers can enumerate and exfiltrate customer personal information and purchase history, manipulate product listings and pricing, create fraudulent discount coupons, or delete store data entirely. While availability impact is rated None in the CVSS score, the high confidentiality and integrity impacts represent a severe business risk for any affected e-commerce store (WPScan, Github Advisory).

A public proof-of-concept is available via the WPScan advisory, demonstrating exploitation through straightforward curl commands requiring no authentication. As of the time of disclosure, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution (WPScan). The EPSS score is approximately 0.045% (14th percentile), indicating a currently low but non-negligible probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify WordPress sites running the "Order Notification for WooCommerce" plugin (slug: woc-order-alert) before version 3.6.3 using tools like WPScan, Shodan, or by probing the /wp-json/wc/v3/ endpoint for an unauthenticated response.
2. Confirm vulnerability: Send an unauthenticated GET request to list products: curl -i "https://target.example.com/wp-json/wc/v3/products?per_page=1". A successful 200 response with product data confirms the plugin is installed and vulnerable.
3. Enumerate store data: Issue unauthenticated GET requests to /wp-json/wc/v3/customers, /wp-json/wc/v3/orders, and /wp-json/wc/v3/coupons to harvest customer PII, order history, and existing discount codes.
4. Manipulate store resources (write): Create a fraudulent coupon: curl -i -X POST "https://target.example.com/wp-json/wc/v3/coupons" -H "Content-Type: application/json" --data '{"code":"EXPLOIT50","discount_type":"percent","amount":"100"}'.
5. Modify or delete products: Update product pricing or delete listings using PUT/DELETE requests to /wp-json/wc/v3/products/<id> to cause business disruption or financial harm. (WPScan)

• Network: Unauthenticated HTTP GET/POST/PUT/DELETE requests to /wp-json/wc/v3/products, /wp-json/wc/v3/coupons, /wp-json/wc/v3/customers, or /wp-json/wc/v3/orders without a valid Authorization header or WooCommerce API key; high volume of REST API requests from a single IP or unusual geographic origin.
• Logs: WordPress/web server access logs showing 200 OK responses to WooCommerce REST API endpoints from unauthenticated sessions; unexpected creation or modification events in WooCommerce order/product/coupon logs.
• Application: Unexpected new coupon codes (e.g., with unusual discount values like 100%) appearing in the WooCommerce coupon list; unexplained changes to product names, descriptions, or pricing; new or modified customer records with no corresponding admin activity. (WPScan)

The vendor has released version 3.6.3 of the "Order Notification for WooCommerce" plugin (woc-order-alert), which restores proper WooCommerce permission checks for REST API requests. All site operators running any version prior to 3.6.3 should update immediately via the WordPress plugin dashboard. As a temporary workaround prior to patching, administrators can disable the plugin or restrict access to the /wp-json/wc/v3/ endpoint at the web server or WAF level to block unauthenticated REST API access (WPScan, Github Advisory).

The vulnerability was discovered and reported by researcher Khaled Alenazi (Nxploited) and verified by WPScan prior to public disclosure. Brief mentions appeared on Mastodon and Bluesky security community feeds shortly after publication, consistent with typical coverage of high-severity WordPress plugin vulnerabilities. No major vendor statements or extended media coverage beyond the WPScan advisory have been identified (WPScan).