CVE-2025-22318: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Eniture Technology's Standard Box Sizes – for WooCommerce plugin affecting versions through 1.6.13. The vulnerability was discovered by researcher Kévin Mosbahi (Mika) and publicly disclosed on January 3, 2025. This security issue is tracked as CVE-2025-22318 (NVD, Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) due to missing authorization checks in a plugin function. This allows unauthenticated attackers to perform unauthorized actions. The vulnerability has received a CVSS v3.1 Base Score of 7.5 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (WPScan, Patchstack).

The vulnerability allows unauthenticated attackers to perform privileged actions without proper authorization. The CVSS score indicates high impact on integrity while confidentiality and availability are not affected (Patchstack).

The vulnerability is considered highly dangerous and expected to become mass exploited according to security researchers. It requires no privileges (unauthenticated access) and no user interaction to exploit (Patchstack).

Users are advised to immediately update to version 1.6.14 or later which contains the fix for this vulnerability. For temporary mitigation, Patchstack has issued a virtual patch to block potential attacks until the update can be applied (Patchstack).