CVE-2025-67958: 
WordPress vulnerability analysis and mitigation

CVE-2025-67958 is a Missing Authorization (Broken Access Control) vulnerability in the TaxCloud for WooCommerce WordPress plugin (slug: simple-sales-tax) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 8.3.8, with version 8.4.0 being the first patched release. The vulnerability was reported on November 9, 2025, and published by Patchstack on January 22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged actions. This allows unauthenticated network-based attackers (no privileges or user interaction required) to invoke functionality that should be restricted to higher-privileged roles. The attack complexity is low, making it straightforward to exploit over the network. The specific unprotected function(s) have not been publicly detailed beyond the Patchstack advisory (Patchstack).

Successful exploitation can result in unauthorized modification of data (integrity impact) and potential exposure of sensitive information (confidentiality impact), as reflected in the updated CVSS vector (C:L/I:L/A:N). An unauthenticated attacker could perform actions reserved for privileged users within the WooCommerce tax configuration context, potentially altering tax settings, order data, or other plugin-managed resources. The availability of the site is not directly impacted, but integrity and limited confidentiality risks are present (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-67958. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

The vendor has released version 8.4.0 of TaxCloud for WooCommerce, which resolves this vulnerability. Site administrators should update the plugin to version 8.4.0 or later immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If an immediate update is not possible, restricting access to the WordPress admin area and REST API endpoints via firewall rules or a web application firewall (WAF) can reduce exposure (Patchstack).