CVE-2026-25455: 
WordPress vulnerability analysis and mitigation

CVE-2026-25455 is a Missing Authorization vulnerability in the PickPlugins Product Slider for WooCommerce WordPress plugin (woocommerce-products-slider). It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels via network requests. All versions up to and including 1.13.61 are affected (ENISA references ≤ 1.13.60 as the boundary). The vulnerability was published on March 25, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, EUVD).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify that a requesting user has the necessary permissions before executing certain privileged actions. An authenticated attacker with a low-privilege account (e.g., a subscriber) can send crafted network requests to endpoints that lack proper capability checks, thereby bypassing intended access control restrictions. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an account is obtained (Feedly, Patchstack).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact, meaning attackers can read sensitive data — such as slider configurations, product data, or other plugin-managed information — without authorization. The scope is unchanged, limiting the blast radius to the affected WordPress installation, but unauthorized access to product or store configuration data could facilitate further reconnaissance or targeted attacks against the site or its customers (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Product Slider for WooCommerce plugin (version ≤ 1.13.61) using tools like WPScan or by inspecting plugin directories/readme files.
2. Obtain low-privilege access: Register or obtain a low-privilege WordPress account (e.g., subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate AJAX actions or REST API endpoints registered by the plugin that lack proper current_user_can() or nonce capability checks.
4. Send crafted request: Issue an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint, bypassing the missing authorization check.
5. Access restricted data: Retrieve slider settings, product configurations, or other data that should be restricted to higher-privileged roles (Feedly).

• Logs: WordPress access logs showing repeated authenticated requests from low-privilege user accounts to plugin-specific AJAX endpoints (/wp-admin/admin-ajax.php) with actions related to woocommerce-products-slider.
• Logs: Unusual access patterns from subscriber-level accounts querying plugin configuration or product slider data outside normal usage hours.
• Network: Automated or scripted HTTP POST requests to wp-admin/admin-ajax.php with plugin-specific action parameters from unexpected IP addresses.

Update the Product Slider for WooCommerce plugin to version 1.13.62 or later, which addresses the missing authorization checks. Site administrators should verify the installed plugin version via the WordPress dashboard under Plugins and apply the update immediately. As a temporary workaround, restricting new user registrations or limiting subscriber-level account creation can reduce the attack surface until patching is feasible (Feedly, Patchstack).