CVE-2025-69401: 
WordPress vulnerability analysis and mitigation

CVE-2025-69401 is an Authentication Bypass by Spoofing vulnerability in the WooODT Lite WordPress plugin (by mdalabar / byconsole), which allows unauthenticated remote attackers to perform identity spoofing and bypass payment or order delivery time controls. The vulnerability affects all versions of WooODT Lite through 2.5.2. It was published on February 20, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, VulDB).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to properly verify the identity of a requester before granting access to protected functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The specific mechanism involves identity spoofing that allows an attacker to manipulate order delivery time or payment-related logic within the WooCommerce integration, effectively bypassing intended access controls (Feedly, Patchstack).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning attackers can manipulate order or payment data on affected WooCommerce stores without authorization. This could allow attackers to bypass payment validation, alter delivery time selections, or spoof order-related identities, potentially leading to financial loss for store operators or fraudulent order fulfillment. The scope is limited to the affected system, but the business impact on e-commerce operations could be significant (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the WooODT Lite plugin to a version beyond 2.5.2 as soon as a patched release is made available by the vendor (byconsole/mdalabar). In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to WooCommerce order endpoints via a web application firewall (WAF). Monitoring order and payment logs for anomalous or unexpected changes to delivery time selections or order statuses is also recommended (Patchstack).