CVE-2025-69093: 
WordPress vulnerability analysis and mitigation

CVE-2025-69093 is a Missing Authorization vulnerability in the wpdesk ShopMagic plugin for WooCommerce (WordPress) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects ShopMagic versions up to and including 4.7.2. The vulnerability was published on December 30, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially accessible to remote attackers. The vulnerability falls under the broader category of broken access control, where restricted functionality can be reached by unauthenticated or unauthorized users due to absent or improperly enforced authorization checks (Feedly, Patchstack).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning attackers can perform unauthorized modifications or actions within the plugin's scope without gaining access to sensitive data or disrupting service. The affected asset is any WordPress site running ShopMagic ≤ 4.7.2 with WooCommerce, potentially exposing e-commerce workflows such as email automation or customer data handling to unauthorized manipulation. The risk of lateral movement or significant data exfiltration appears limited based on available information (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-69093 as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the ShopMagic plugin to a version beyond 4.7.2, as all versions up to and including 4.7.2 are affected. Site administrators should check the WordPress plugin repository or the wpdesk vendor site for the latest patched release and apply it promptly. As a temporary measure, consider disabling the plugin if an immediate update is not possible, and review access control configurations for WooCommerce-related plugins (Patchstack).