CVE-2025-69381

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69381", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-31T20:13:05.452Z", "datePublished": "2026-02-20T15:46:53.591Z", "dateUpdated": "2026-04-28T20:57:25.741Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "woocommerce-quick-product-editor", "product": "WooCommerce Bulk Product Editor", "vendor": "vanquish", "versions": [{"lessThanOrEqual": "3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:13.247Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.</p>"}], "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:39.776Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:02:28.954278Z", "id": "CVE-2025-69381", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T20:57:25.741Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-69381", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:02:28.954278Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:00:19.544Z"}}], "cna": {"title": "WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "vanquish", "product": "WooCommerce Bulk Product Editor", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0"}], "packageName": "woocommerce-quick-product-editor", "collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:04:13.247Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:13:26.355Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69381", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:13:26.355Z", "dateReserved": "2025-12-31T20:13:05.452Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:53.591Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "woocommerce-quick-product-editor", "product": "WooCommerce Bulk Product Editor", "vendor": "vanquish", "versions": [{"lessThanOrEqual": "3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a WooCommerce Bulk Product Editor: desde n/a hasta &lt;= 3.0."}], "id": "CVE-2025-69381", "lastModified": "2026-06-17T10:00:35.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69381", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:02:28.954278Z", "version": "2.0.3"}}]}, "published": "2026-02-20T16:22:22.707", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-quick-product-editor/vulnerability/wordpress-woocommerce-bulk-product-editor-plugin-3-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WooCommerce Bulk Product Editor", "source": "cna", "vendor": "vanquish"}, "product": "woocommerce_bulk_product_editor", "vendor": "vanquish"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T17:37:59.496157+00:00", "value": {"mitigation_remediation": ["Upgrade WooCommerce Bulk Product Editor to any version newer than\u00a03.0, when such a release is available.", "If an upgrade cannot be performed immediately, enforce strict role\u2011based access control by restricting all Bulk Product Editor actions to administrators only, using WordPress role manager or a security plugin.", "If the plugin is not required for immediate operations, disable or remove it from the site until a fixed release is available."], "summary": {"action": "Apply Patch", "impact": "Unauthorized modification of product data"}, "threat_synthesis": {"affected_systems": "The issue affects the WooCommerce Bulk Product Editor plugin developed by vanquish and applies to all releases up to and including version\u00a03.0. Users running any of these versions are vulnerable.", "description_and_impact": "A missing authorization check in the WooCommerce Bulk Product Editor plugin allows an attacker with administrative interface access to perform privileged operations on product records. An attacker who can reach the plugin\u2019s administrative pages may add, edit or delete products without proper permission verification, thereby compromising the integrity of store inventory. The flaw is a classic broken access control vulnerability (CWE\u2011862) that can directly alter product information, pricing, and availability, potentially leading to financial loss or erosion of customer trust.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity level. The EPSS score of less than 1\u00a0% shows that the probability of exploitation is currently very low, and the vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the likely attack vector requires access to the WordPress admin area, and the attacker must authenticate with a role that the plugin incorrectly trusts as having full product management rights. This means an attacker who can log in as an editor or developer, or who exploits a separate authentication weakness, can exploit the access\u2011control flaw. The risk is elevated for sites that expose the plugin\u2019s administrative pages to untrusted users or that have weak role configurations."}}}}, "created": "2026-02-23T14:37:13.046781+00:00", "updated": "2026-04-28T17:45:16.129498+00:00", "vendors": ["vanquish", "vanquish$PRODUCT$woocommerce_bulk_product_editor", "wordpress", "wordpress$PRODUCT$wordpress"]}