CVE-2025-3743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3743", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-16T17:46:38.616Z", "datePublished": "2025-04-25T06:45:29.320Z", "dateUpdated": "2026-04-08T17:16:03.915Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:03.915Z"}, "affected": [{"vendor": "wpswings", "product": "Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart."}], "title": "Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e1546b-c8cc-4d57-9909-153209e3a9c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1773"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1818"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1829"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1771"}, {"url": "https://plugins.trac.wordpress.org/changeset/3279944/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "cweId": "CWE-472", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "pwn4TheLulz"}], "timeline": [{"time": "2025-04-24T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-25T14:29:40.422880Z", "id": "CVE-2025-3743", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T14:29:52.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-25T14:29:40.422880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T14:29:46.942Z"}}], "cna": {"title": "Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "pwn4TheLulz"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wpswings", "product": "Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-24T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e1546b-c8cc-4d57-9909-153209e3a9c6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1773"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1818"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1829"}, {"url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1771"}, {"url": "https://plugins.trac.wordpress.org/changeset/3279944/"}], "descriptions": [{"lang": "en", "value": "The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:03.915Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3743", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:16:03.915Z", "dateReserved": "2025-04-16T17:46:38.616Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-25T06:45:29.320Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.", "vendor": "wpswings", "versions": [{"lessThanOrEqual": "3.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart."}, {"lang": "es", "value": "El complemento Upsell Funnel Builder para WooCommerce de WordPress es vulnerable a la manipulaci\u00f3n de pedidos en todas las versiones hasta la 3.0.0 incluida. Esto se debe a que el complemento permite manipular el ID de producto adicional y el campo de descuento antes del procesamiento mediante la funci\u00f3n \"add_offer_in_cart\". Esto permite que atacantes no autenticados actualicen arbitrariamente el producto asociado a cualquier aumento de pedido y el descuento aplicado a cualquier art\u00edculo al a\u00f1adirlo al carrito."}], "id": "CVE-2025-3743", "lastModified": "2026-06-17T09:20:35.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3743", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-25T14:29:40.422880Z", "version": "2.0.3"}}]}, "published": "2025-04-25T07:15:47.980", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1771"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1773"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1818"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1829"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3279944/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e1546b-c8cc-4d57-9909-153209e3a9c6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-472"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:07:46.657039+00:00", "value": {"mitigation_remediation": ["Upgrade the Upsell Funnel Builder for WooCommerce plugin to the latest version that removes the flaw.", "If an upgrade is not feasible, either disable the add_offer_in_cart functionality or uninstall the plugin entirely to eliminate the vulnerability.", "Apply a web application firewall rule or configure WooCommerce to restrict unauthenticated users from accessing order modification endpoints.", "Implement server-side validation to verify that product IDs and discount amounts are legitimate before applying them to the cart."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated Order Manipulation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WPSWings Upsell Funnel Builder for WooCommerce plugin for WordPress in all releases up to and including version 3.0.0. Any site running these versions of the plugin is at risk.", "description_and_impact": "The Upsell Funnel Builder for WooCommerce plugin has been found to allow unauthenticated order manipulation in all versions up to 3.0.0. By tampering with the additional product ID and discount value before they are processed in the add_offer_in_cart function, an attacker can arbitrarily change the product associated with any order bump and the discount applied to it. This flaw enables unauthorized modification of cart contents and pricing, which can lead to financial loss by altering purchase totals or providing free or discounted goods.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation. Since the vulnerability is not listed in the CISA KEV catalog, it currently has no known widespread exploitation. The likely attack vector is unauthenticated remote access through the public checkout flow, where an attacker can send crafted requests to the plugin's add_offer_in_cart endpoint. If the attacker succeeds, they can set arbitrary product IDs and discount values for order bump items, potentially altering order totals and revenue."}}}}, "created": "2026-04-20T23:15:06.306918+00:00", "updated": "2026-04-20T23:15:06.306931+00:00", "vendors": []}