CVE-2025-15484 - Vulnerability Analysis

Overview

Order Notification for WooCommerce WordPress plugin < 3.6.3 contains a broken access control vulnerability caused by overriding WooCommerce's permission checks, letting unauthenticated attackers gain full read/write access to store resources.

Severity & Score

Impact

Unauthenticated attackers can read and modify store resources including products, coupons, and customers, leading to full store compromise.

Mitigation

Upgrade to version 3.6.3 or later.

References

• https://wpscan.com/vulnerability/ee9f1c0c-86bb-4922-9eb5-8aae78003eff/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner