CVE-2025-15033
Full vulnerability record from the local CVENow database.
Description
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-12-22 19:15:48.510000
Last modified
2026-10-19 22:10:00.130000
View original CVE JSON
{
"id": "CVE-2025-15033",
"sourceIdentifier": "[email protected]",
"published": "2025-12-22T19:15:48.510",
"lastModified": "2026-10-19T22:10:00.130",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier."
},
{
"lang": "es",
"value": "Una vulnerabilidad en WooCommerce de la versión 8.1 a la 10.4.2 puede permitir a clientes autenticados acceder a los datos de pedidos de clientes invitados en sitios con una configuración específica. Esto se ha corregido en WooCommerce 10.4.3, así como en todas las versiones previamente afectadas mediante versiones puntuales, a partir de la 8.1, donde se solucionó en la 8.1.3. No afecta a WooCommerce 8.0 ni versiones anteriores."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Automattic",
"product": "WooCommerce",
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins",
"versions": [
{
"version": "8.1.0",
"lessThan": "8.1.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.2.0",
"lessThan": "8.2.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.3.0",
"lessThan": "8.3.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.4.0",
"lessThan": "8.4.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.5.0",
"lessThan": "8.5.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.6.0",
"lessThan": "8.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.7.0",
"lessThan": "8.7.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.8.0",
"lessThan": "8.8.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.9.0",
"lessThan": "8.9.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.0.0",
"lessThan": "9.0.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.1.0",
"lessThan": "9.1.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.2.0",
"lessThan": "9.2.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.3.0",
"lessThan": "9.3.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.4.0",
"lessThan": "9.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.5.0",
"lessThan": "9.5.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.6.0",
"lessThan": "9.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.7.0",
"lessThan": "9.7.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.8.0",
"lessThan": "9.8.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.9.0",
"lessThan": "9.9.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.0.0",
"lessThan": "10.0.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.1.0",
"lessThan": "10.1.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.2.0",
"lessThan": "10.2.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.3.0",
"lessThan": "10.3.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.4.0",
"lessThan": "10.4.3",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-12-22T23:55:39.079754Z",
"id": "CVE-2025-15033",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/f55fd7d3-7fbe-474f-9406-f47f8aee5e57/",
"source": "[email protected]"
}
]
}