CVE-2025-12955

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12955", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-10T14:48:53.588Z", "datePublished": "2025-11-18T09:27:36.608Z", "dateUpdated": "2026-04-08T16:40:30.736Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:30.736Z"}, "affected": [{"vendor": "rajeshsingh520", "product": "PiWeb Live sales notification for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.39", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the \"getOrders\" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details."}], "title": "Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394241%40live-sales-notifications-for-woocommerce&old=3389540%40live-sales-notifications-for-woocommerce&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-02T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-11T01:56:09.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-17T20:54:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:32:15.046680Z", "id": "CVE-2025-12955", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:32:24.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:32:15.046680Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:32:20.815Z"}}], "cna": {"title": "Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "rajeshsingh520", "product": "PiWeb Live sales notification for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.39"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-02T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-11T01:56:09.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-17T20:54:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394241%40live-sales-notifications-for-woocommerce&old=3389540%40live-sales-notifications-for-woocommerce&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the \"getOrders\" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:30.736Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12955", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:40:30.736Z", "dateReserved": "2025-11-10T14:48:53.588Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T09:27:36.608Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PiWeb Live sales notification for WooCommerce", "vendor": "rajeshsingh520", "versions": [{"lessThanOrEqual": "2.3.39", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the \"getOrders\" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details."}, {"lang": "es", "value": "El plugin \u201cLive sales notification for WooCommerce\u201d para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 2.3.39, inclusive. Esto se debe a que la funci\u00f3n \u201cgetOrders\u201d carece de las comprobaciones adecuadas de autorizaci\u00f3n y capacidad cuando el plugin est\u00e1 configurado para mostrar informaci\u00f3n de pedidos recientes. Esto permite a atacantes no autenticados extraer informaci\u00f3n sensible del cliente, incluyendo nombres de pila del comprador, ciudad, estado, pa\u00eds, fecha y hora de compra, y detalles del producto."}], "id": "CVE-2025-12955", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12955", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:32:15.046680Z", "version": "2.0.3"}}]}, "published": "2025-11-18T10:15:48.710", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394241%40live-sales-notifications-for-woocommerce&old=3389540%40live-sales-notifications-for-woocommerce&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:09:03.631650+00:00", "value": {"mitigation_remediation": ["Upgrade the Live Sales Notification for WooCommerce plugin to a version newer than 2.3.39, where the authorization check has been restored.", "Verify that the plugin\u2019s order display settings are configured to restrict access to logged\u2011in users with the appropriate capabilities, and disable any public display options if not needed.", "Review custom integrations or hooks that access order data to ensure they enforce proper authorization checks before exposing customer information."], "summary": {"action": "Patch Plugin", "impact": "Sensitive Customer Data Exposure"}, "threat_synthesis": {"affected_systems": "This issue affects the RajeshSingh520 PiWeb Live Sales Notification for WooCommerce plugin for WordPress, versions up to and including 2.3.39. The vulnerability is present in all installations of these versions where the recent order display feature is enabled. Upgrading to versions newer than 2.3.39 removes the flaw.", "description_and_impact": "The Live Sales Notification for WooCommerce plugin is vulnerable due to a missing authorization check in the getOrders function. This flaw allows any user to retrieve customer order details\u2014including first names, location, purchase time, and product information\u2014without authentication. The weakness is classified as a Missing Authorization (CWE-862) and results in unauthorized disclosure of sensitive customer data.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high level of risk, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The flaw is not currently listed in CISA's KEV catalog. Exploitation would require sending an unauthenticated request to the getOrders endpoint, which is reachable over the network once the plugin is installed. The attack is simple and does not require elevated privileges, making it a potentially attractive vector for attackers seeking direct data exposure."}}}}, "created": "2025-11-19T10:48:05.503113+00:00", "updated": "2026-04-22T21:15:27.681776+00:00", "vendors": ["rajeshsingh520", "rajeshsingh520$PRODUCT$live_sales_notification_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}