CVE-2025-54004: 
WordPress vulnerability analysis and mitigation

CVE-2025-54004 is a Missing Authorization (Broken Access Control) vulnerability in the WCFM – Frontend Manager for WooCommerce WordPress plugin developed by WC Lovers. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially performing actions beyond their intended permission scope. The vulnerability affects all plugin versions up to and including 6.7.24, with version 6.7.25 being the patched release. It was reported by researcher benzdeus on November 16, 2025, and publicly disclosed on December 15–16, 2025. The CNA (Patchstack) assigned a CVSS v3.1 base score of 2.7 (Low) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more functions within the plugin fail to perform adequate authorization checks before executing privileged actions. This allows an authenticated user — specifically one with a Store Vendor role — to invoke functionality that should be restricted to higher-privileged roles such as administrators. The attack vector is network-based, requiring low privileges and no user interaction per the Patchstack CVSS assessment. No public proof-of-concept code or detailed technical write-up has been published at this time (Patchstack).

Successful exploitation of this vulnerability could allow a lower-privileged authenticated user (e.g., a WooCommerce store vendor) to perform actions reserved for higher-privileged roles, potentially affecting the availability of certain plugin functionality. The Patchstack CVSS assessment indicates limited availability impact with no confidentiality or integrity impact, making this a low-severity issue with minimal data exposure risk. Lateral movement or significant system compromise is unlikely given the constrained impact scope (Patchstack).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-54004. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited (Patchstack).

The vendor has released version 6.7.25 of the WCFM – Frontend Manager for WooCommerce plugin, which resolves this vulnerability. Site administrators should update the plugin to version 6.7.25 or later as soon as possible via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround has been published; updating to the patched version is the only recommended remediation (Patchstack).