CVE-2025-15033

WooCommerce - Subscriber/Customer+ Order Data Disclosure

View on CVE.org
Published Dec 22, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Automattic
Automattic woocommerce
Vendors & Products Automattic
Automattic woocommerce
Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
Title WooCommerce - Subscriber/Customer+ Order Data Disclosure
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Mar 6, 2026, 9:09 AM
Reserved
Dec 22, 2025, 3:54 PM

View source JSON

Updated
Dec 22, 2025, 11:56 PM

JSON

Status
Deferred
Published
Dec 22, 2025, 7:15 PM
Modified
Oct 19, 2026, 10:10 PM

View source JSON

No data.

Updated
Dec 23, 2025, 10:39 PM

JSON