CVE-2025-57957: 
WordPress vulnerability analysis and mitigation

CVE-2025-57957 is a Missing Authorization (Broken Access Control) vulnerability in the WooMS WordPress plugin by wpcraft. It affects all versions of WooMS from n/a through 9.12, allowing unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was published on September 22, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The specific plugin functionality lacking authorization checks has not been publicly detailed in available sources, but the vulnerability class typically involves unprotected AJAX handlers or REST API endpoints in WordPress plugins (Feedly, Patchstack).

Successful exploitation results in a limited integrity impact — unauthenticated attackers can perform unauthorized actions within the scope of the vulnerable plugin's functionality, such as modifying plugin data or settings. Confidentiality and availability are not directly impacted according to the CVSS assessment. The practical risk depends on what actions the unprotected endpoints expose, but in WooCommerce-integrated environments, unauthorized data manipulation could affect product listings, orders, or synchronization settings (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-57957. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term (Feedly).

Users should update the WooMS plugin to a version beyond 9.12 as soon as a patched release is made available by the vendor (wpcraft). In the interim, site administrators can mitigate risk by restricting access to the WordPress admin area and REST API endpoints via firewall rules or a Web Application Firewall (WAF). Monitoring plugin activity logs for unexpected or unauthorized actions is also recommended (Patchstack, Wordfence).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the period of September 22–28, 2025, as part of routine community tracking of WordPress plugin security issues. No significant vendor statements or notable researcher commentary beyond standard disclosure have been identified (Wordfence).