CVE-2025-24633: 
WordPress vulnerability analysis and mitigation

The Build Private Store For Woocommerce plugin for WordPress contains a Missing Authorization vulnerability (CVE-2025-24633) in versions up to and including 1.0. The vulnerability was discovered by Kévin Mosbahi (Mika) and was publicly disclosed on January 24, 2025. This security issue affects the plugin's functionality due to a missing capability check (WPScan, Patchstack).

The vulnerability stems from a missing capability check on a function that allows unauthenticated attackers to perform unauthorized actions. The issue has been assigned a CVSS score of 5.3 (Medium) and is classified under CWE-862 (Missing Authorization). The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control (WPScan, Patchstack).

The vulnerability allows unauthenticated attackers to perform unauthorized actions within the plugin's functionality, potentially leading to security breaches in WordPress installations using the affected versions (Patchstack).

The vulnerability has been fixed in version 1.1 of the Build Private Store For Woocommerce plugin. Users are advised to update to this version to protect their installations. The security issue has been assessed as having a low severity impact and is unlikely to be exploited, but updating is still recommended as a security best practice (Patchstack).