CVE-2025-9054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9054", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-14T23:35:02.860Z", "datePublished": "2025-09-24T11:18:32.303Z", "dateUpdated": "2026-04-08T16:58:46.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:46.200Z"}, "affected": [{"vendor": "Techspawn", "product": "MultiLoca - WooCommerce Multi Locations Inventory Management", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}], "title": "MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586#item-description__changelog"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "timeline": [{"time": "2025-09-08T17:18:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-23T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-24T13:01:32.825316Z", "id": "CVE-2025-9054", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T13:01:40.050Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-24T13:01:32.825316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T13:01:35.917Z"}}], "cna": {"title": "MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'", "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Techspawn", "product": "MultiLoca - WooCommerce Multi Locations Inventory Management", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-08T17:18:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-23T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586#item-description__changelog"}], "descriptions": [{"lang": "en", "value": "The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:46.200Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9054", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:46.200Z", "dateReserved": "2025-08-14T23:35:02.860Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-24T11:18:32.303Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MultiLoca - WooCommerce Multi Locations Inventory Management", "vendor": "Techspawn", "versions": [{"lessThanOrEqual": "4.2.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}, {"lang": "es", "value": "El plugin MultiLoca - WooCommerce Multi Locations Inventory Management para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos que puede conducir a la escalada de privilegios debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n 'wcmlim_settings_ajax_handler' en todas las versiones hasta la 4.2.8, inclusive. Esto hace posible que atacantes no autenticados actualicen opciones arbitrarias en el sitio de WordPress. Esto puede ser aprovechado para actualizar el rol predeterminado para el registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso de usuario administrativo a un sitio vulnerable."}], "id": "CVE-2025-9054", "lastModified": "2026-06-17T10:08:14.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9054", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-24T13:01:32.825316Z", "version": "2.0.3"}}]}, "published": "2025-09-24T12:15:29.760", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586#item-description__changelog"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:49:19.616906+00:00", "value": {"mitigation_remediation": ["Upgrade MultiLoca to the latest version where the Ajax handler's capability check has been restored.", "Temporarily disable or remove the 'wcmlim_settings_ajax_handler' endpoint if a plugin upgrade cannot be applied immediately.", "Change WordPress settings to set the default user role to 'Subscriber' and disable user registration until the plugin is patched.", "Monitor server logs for unusual Ajax requests targeting 'wcmlim_settings_ajax_handler' as an additional precaution."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation via Unauthenticated Options Update"}, "threat_synthesis": {"affected_systems": "All installations of Techspawn's MultiLoca \u2013 WooCommerce Multi Locations Inventory Management plugin for WordPress versions 4.2.8 and earlier are affected. The vulnerability resides in the 'wcmlim_settings_ajax_handler' function that handles configuration changes in the plugin.", "description_and_impact": "The MultiLoca plugin for WordPress suffers a missing authorization check on its Ajax handler, enabling unauthenticated users to modify arbitrary WordPress options. This flaw can be abused to change the registration default role to administrator and to enable free user registration, effectively granting an attacker the ability to create an administrator account. The resulting privilege escalation violates confidentiality, integrity, and availability by allowing a malicious actor to assume full control of the web site.", "risk_and_exploitability": "The CVSS score of 9.8 marks this as critical, while the EPSS score of less than 1% implies an overall low probability of exploitation in the wild at this time. The flaw is listed as not in the CISA KEV catalog. An attacker would exploit the exposed Ajax endpoint by sending a crafted HTTP request without authentication, leveraging the lack of capability checks to update options. Successful exploitation escalates privileges to administrator, providing full control over the site."}}}}, "created": "2025-09-25T08:21:29.356199+00:00", "updated": "2026-04-21T03:00:06.374513+00:00", "vendors": ["techspawn", "techspawn$PRODUCT$multiloca", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}