CVE-2025-5813: 
WordPress vulnerability analysis and mitigation

The Amazon Products to WooCommerce plugin for WordPress contains a vulnerability (CVE-2025-5813) discovered and disclosed on June 25, 2025. The vulnerability affects all versions up to and including 1.2.7, where a missing capability check in the wcta2w_get_amazon_product_callback() function allows unauthorized data modification (NVD CVE, Wiz Report).

The vulnerability stems from a missing capability check in the wcta2w_get_amazon_product_callback() function. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD CVE).

The vulnerability allows unauthenticated attackers to create new products in the WooCommerce store without proper authorization. This could lead to the insertion of malicious or unauthorized products into the e-commerce platform, potentially affecting the store's integrity and business operations (Wiz Report).

Users should update their Amazon Products to WooCommerce plugin to a version newer than 1.2.7 once available. Until then, website administrators should consider disabling the plugin if it's not critical to operations (Wiz Report).