CVE-2025-15484

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.

Score

CVSS 3.1 9.1 Critical

Status

Deferred - contact@wpscan.com

Published

2026-04-01

Last modified

2026-10-07

Weaknesses

CWE-287

Affected products

• Order Notification For Woocommerce (Unknown)

References

• https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/