CVE-2025-12584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12584", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T21:58:43.201Z", "datePublished": "2025-11-27T09:27:49.113Z", "dateUpdated": "2026-04-08T17:03:36.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:36.134Z"}, "affected": [{"vendor": "shapedplugin", "product": "Quick View for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to."}], "title": "Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/809472d5-1698-42da-b414-1dda40983a6e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402213%40woo-quickview&new=3402213%40woo-quickview&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-13T16:23:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T20:53:07.172130Z", "id": "CVE-2025-12584", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T20:53:15.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T20:53:07.172130Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T20:53:12.307Z"}}], "cna": {"title": "Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "shapedplugin", "product": "Quick View for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.17"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-13T16:23:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-26T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/809472d5-1698-42da-b414-1dda40983a6e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402213%40woo-quickview&new=3402213%40woo-quickview&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:36.134Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12584", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:36.134Z", "dateReserved": "2025-10-31T21:58:43.201Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-27T09:27:49.113Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quick View for WooCommerce", "vendor": "shapedplugin", "versions": [{"lessThanOrEqual": "2.2.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to."}, {"lang": "es", "value": "El plugin Quick View for WooCommerce para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n en todas las versiones hasta e incluyendo la 2.2.17, a trav\u00e9s del endpoint AJAX 'wqv_popup_content', debido a restricciones insuficientes sobre qu\u00e9 productos pueden incluirse. Esto hace posible que atacantes no autenticados extraigan datos de productos privados a los que no deber\u00edan tener acceso."}], "id": "CVE-2025-12584", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12584", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T20:53:07.172130Z", "version": "2.0.3"}}]}, "published": "2025-11-27T10:15:50.760", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402213%40woo-quickview&new=3402213%40woo-quickview&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/809472d5-1698-42da-b414-1dda40983a6e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:23:42.972073+00:00", "value": {"mitigation_remediation": ["Upgrade Quick View for WooCommerce to the latest version (greater than\u00a02.2.17).", "If an upgrade is not immediately possible, disable the wqv_popup_content AJAX endpoint or restrict its access to authenticated users only.", "Ensure product visibility settings are correctly configured so that private products remain hidden from public queries."], "summary": {"action": "Update Plugin", "impact": "Private Product Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Quick View for WooCommerce plugin developed by shapedplugin. All plugin versions up to and including 2.2.17 are impacted. Versions newer than 2.2.17 are not reported as vulnerable.", "description_and_impact": "The Quick View for WooCommerce plugin is vulnerable to information exposure, allowing attackers who are not authenticated to retrieve details about private products. The flaw resides in the wqv_popup_content AJAX endpoint, which does not restrict visibility of private products. Affected data can include product titles, descriptions, prices, and any other metadata exposed through the endpoint, leading to unwanted disclosure of sensitive e\u2011commerce information.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated requests to the wqv_popup_content endpoint, which returns private product data without enforcing access control."}}}}, "created": "2025-11-27T16:26:21.592360+00:00", "updated": "2026-04-22T00:30:04.049994+00:00", "vendors": ["shapedplugin", "shapedplugin$PRODUCT$quick_view", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}