CVE-2025-68018: 
WordPress vulnerability analysis and mitigation

CVE-2025-68018 is a Missing Authorization (Broken Access Control) vulnerability in the Order Listener for WooCommerce WordPress plugin (slug: woc-order-alert), developed by StackWC (formerly attributed to ilmosys). It allows unauthenticated network attackers to exploit incorrectly configured access control security levels, bypassing authorization checks entirely. All versions up to and including 3.6.1 are affected; version 3.6.2 contains the fix. The vulnerability was reported on October 30, 2025, published by Patchstack on January 19–22, 2026, and carries a CVSS v3.1 base score of 9.4 (Critical) as assessed by CISA-ADP (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to perform proper authorization or nonce token checks on one or more sensitive functions, allowing unauthenticated users to invoke actions that should be restricted to privileged roles. This falls under OWASP Top 10 category A1: Broken Access Control. Exploitation requires no authentication, no user interaction, and low attack complexity — an attacker simply sends a crafted network request to the vulnerable plugin endpoint to trigger unauthorized functionality. The vulnerability was discovered and credited to researcher NumeX and reported through Patchstack's coordinated disclosure process (Patchstack).

Successful exploitation allows an unauthenticated attacker to access and modify WooCommerce order data without authorization, resulting in high confidentiality and integrity impact and low availability impact. Attackers could view sensitive customer and order information, manipulate order statuses or data, and potentially disrupt order processing workflows. Patchstack notes that vulnerabilities of this severity class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns it is the type of vulnerability expected to be used in mass-exploit campaigns against WordPress sites (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites running the Order Listener for WooCommerce plugin (woc-order-alert) version ≤ 3.6.1 using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at https://target.com/wp-content/plugins/woc-order-alert/readme.txt.
2. Identify vulnerable endpoint: Enumerate the plugin's registered WordPress AJAX actions or REST API endpoints that lack authorization checks — these are the entry points for unauthenticated access.
3. Craft unauthenticated request: Send a direct HTTP POST or GET request to the vulnerable endpoint (e.g., https://target.com/wp-admin/admin-ajax.php?action=<vulnerable_action>) without any authentication cookies, nonce tokens, or credentials.
4. Access or modify order data: The missing authorization check allows the request to succeed, granting the attacker the ability to read sensitive WooCommerce order details (customer PII, order contents) or modify order statuses and data.
5. Exfiltrate or manipulate: Extract order data for fraud or further attacks, or manipulate orders to cause business disruption (Patchstack).

• Network: Unusual unauthenticated POST or GET requests to wp-admin/admin-ajax.php with plugin-specific action parameters related to woc-order-alert; repeated requests from a single IP or IP range targeting WooCommerce order endpoints.
• Logs: WordPress access logs showing requests to AJAX or REST endpoints associated with the woc-order-alert plugin from unauthenticated sessions (no valid session cookies); HTTP 200 responses to requests that should require authentication.
• File System: Presence of plugin version ≤ 3.6.1 confirmed via wp-content/plugins/woc-order-alert/readme.txt or plugin header files.
• Application: Unexpected changes to WooCommerce order statuses, order notes, or order data without corresponding authenticated admin activity in WordPress audit logs (Patchstack).

The vendor has released version 3.6.2 of Order Listener for WooCommerce, which patches this vulnerability — update immediately via the WordPress plugin dashboard (Patchstack). If immediate update is not possible, consider temporarily deactivating the plugin until patching is feasible. As an interim measure, implement network-level or WAF rules to restrict access to the plugin's AJAX/REST endpoints, and review access logs for suspicious unauthenticated activity. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploit attempts automatically until the plugin is updated.

Patchstack, which discovered and disclosed the vulnerability through researcher NumeX, issued a high-priority classification and noted that vulnerabilities of this type are commonly weaponized in mass-exploit campaigns against WordPress sites. The CVE description was updated on April 1, 2026, to reflect the correct vendor attribution (StackWC instead of ilmosys), indicating active maintenance of the advisory. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).