CVE-2025-9286

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9286", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-20T21:29:49.417Z", "datePublished": "2025-10-03T11:17:10.009Z", "dateUpdated": "2026-04-08T16:46:14.529Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:14.529Z"}, "affected": [{"vendor": "hancock11", "product": "Appy Pie Connect for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access."}], "title": "Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php"}, {"url": "https://wordpress.org/plugins/appy-pie-connect-for-woocommerce/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3385150/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-620 Unverified Password Change", "cweId": "CWE-620", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-10-02T22:31:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:02:51.622311Z", "id": "CVE-2025-9286", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:03:05.831Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9286", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T18:02:51.622311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:02:59.160Z"}}], "cna": {"title": "Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "hancock11", "product": "Appy Pie Connect for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:31:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php"}, {"url": "https://wordpress.org/plugins/appy-pie-connect-for-woocommerce/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3385150/"}], "descriptions": [{"lang": "en", "value": "The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-620", "description": "CWE-620 Unverified Password Change"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:14.529Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9286", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:46:14.529Z", "dateReserved": "2025-08-20T21:29:49.417Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:10.009Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Appy Pie Connect for WooCommerce", "vendor": "hancock11", "versions": [{"lessThanOrEqual": "1.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access."}, {"lang": "es", "value": "El plugin Appy Pie Connect para WooCommerce para WordPress es vulnerable a la escalada de privilegios debido a la falta de autorizaci\u00f3n dentro del gestor REST reset_user_password() en todas las versiones hasta la 1.1.2, ambas inclusive. Esto hace posible que atacantes no autenticados restablezcan la contrase\u00f1a de usuarios arbitrarios, incluyendo administradores, obteniendo as\u00ed acceso administrativo."}], "id": "CVE-2025-9286", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9286", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:02:51.622311Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:47.757", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3385150/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/appy-pie-connect-for-woocommerce/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-620"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:57:44.382885+00:00", "value": {"mitigation_remediation": ["Update the Appy Pie Connect for WooCommerce plugin to the latest version (1.1.3 or newer).", "If an upgrade is not feasible, disable or remove the reset_user_password REST endpoint.", "Force a password reset for all existing users or revoke existing passwords.", "Restrict REST API access to authenticated or trusted IP ranges, or require authentication for all endpoints to prevent similar weaknesses."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation via Unauthenticated Password Reset"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Appy Pie Connect for WooCommerce WordPress plugin supplied by hancock11. All releases up to and including version 1.1.2 are impacted; later releases are not affected.", "description_and_impact": "A missing authorization check in the reset_user_password REST handler of the Appy Pie Connect for WooCommerce plugin allows an attacker to reset the password of any user, including administrators. This results in full administrative access once the new password is set. Based on the description, it is inferred that this flaw is a classic authorization bypass (CWE\u2011620).", "risk_and_exploitability": "The CVSS score of 9.8 classifies the flaw as critical, while the EPSS score of less than 1% indicates a low current exploitation probability. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves sending a crafted HTTP request to the WordPress REST API endpoint that handles password resets, with no authentication or other prerequisites required, allowing any internet\u2011accessible attacker to compromise accounts."}}}}, "created": "2025-10-06T14:42:47.573453+00:00", "updated": "2026-04-21T19:00:36.142594+00:00", "vendors": ["hancock11", "hancock11$PRODUCT$appy_pie_connect_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}