CVE-2025-22667: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin, affecting versions through 1.8.2. The vulnerability was discovered by Kévin Mosbahi (Mika) and was publicly disclosed on February 3, 2025 (WPScan, Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access and above to perform unauthorized actions due to missing capability checks in the plugin's functionality (WPScan).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. It has been classified as a broken access control issue, which refers to a missing authorization, authentication, or nonce token check in a function (Patchstack).

The vulnerability has been fixed in version 1.9 of the plugin. Users are advised to update to version 1.9 or later to remove the vulnerability. The security issue has been assessed as having a low severity impact and is unlikely to be exploited (Patchstack).