CVE-2025-15484 — Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

CVE-2025-15484

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass PUBLISHED

Description (CNA)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.

Affected (CNA)

Vendor / product	Versions
Unknown / Order Notification for WooCommerce	affected 0 before 3.6.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.