dbcve.org
Information ExposureWeakness · CWE-200

CVE-2025-15033

MEDIUM · 6.5 CVSS v3.1 Published 2025-12-22
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
71/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

WooCommerce versions 8.1 through 10.4.2 contain an authorization bypass vulnerability where logged-in customer accounts can access order data belonging to guest customers on sites with specific configuration. This is likely an Insecure Direct Object Reference (IDOR) flaw where order IDs are not properly validated against the authenticated user's ownership. The exact configuration requirements are not detailed in the advisory.

MitigationUpdate WooCommerce to version 10.4.3, or for older branches, update to the corresponding patched version (8.1.3 or later for the 8.x branch). Review user access controls after updating to ensure no unauthorized access occurred.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify WooCommerce version
    Check the installed WooCommerce version via WordPress admin (WooCommerce > Extensions > WooCommerce.com Subscriptions) or by querying the wp_options table: SELECT option_value FROM wp_options WHERE option_name = 'woocommerce_version' OR option_name = 'woocommerce_db_version';
    Affected if The installed version falls between 8.1 and 10.4.2 inclusive
  2. Confirm WooCommerce is active
    Verify WooCommerce plugin is active by checking wp_options table: SELECT option_value FROM wp_options WHERE option_name = 'active_plugins';
    Affected if WooCommerce appears in the active plugins list, indicating the plugin is enabled
  3. Determine if guest checkout is enabled
    Check WooCommerce checkout settings: look for woocommerce_enable_guest_checkout or woocommerce_registration_generate_username options in wp_options table, or inspect the checkout settings via admin panel under WooCommerce > Settings > Accounts
    Affected if Guest checkout is enabled (allowing orders without account creation), which creates the guest order data that could be accessed
  4. Review order access patterns
    Test whether authenticated customer accounts can access order data by querying orders not associated with their user ID via the REST API or frontend order history pages. Check wp_posts and wp_postmeta for order post type and associated customer user IDs.
    Affected if Logged-in customers can view or retrieve order details for orders belonging to different users (guest or other customers)

A site is affected if WooCommerce versions 8.1 through 10.4.2 are installed AND guest checkout is enabled, allowing potential unauthorized access to guest order data by authenticated customers.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Update WooCommerce to version 10.4.3, or for older branches, update to the corresponding patched version (8.1.3 or later for the 8.x branch). Review user access controls after updating to ensure no unauthorized access occurred.

Recommended fix High confidence

WooCommerce 10.4.3+ (or WooCommerce 8.1.3+ for the 8.1.x branch)

  1. 1. Back up your WordPress database and files before proceeding with any update.
  2. 2. Log in to your WordPress admin dashboard.
  3. 3. Navigate to Dashboard > Updates (or Plugins > All Plugins to check for WooCommerce update).
  4. 4. Look for WooCommerce update notification and review the changelog to confirm it includes the security fix for CVE-2025-15033.
  5. 5. Click to update WooCommerce to the latest version (10.4.3 or higher for 9.x-10.x branches, 8.1.3 or higher for 8.1.x branch).
  6. 6. After update, verify the WooCommerce version under WooCommerce > Status > WooCommerce.
  7. 7. Test that customer accounts can only access their own orders and not guest order data to confirm the fix is working.
Caveat Minor version updates typically contain bug/security fixes with minimal breaking change risk; review the WooCommerce changelog for any deprecation notices specific to your version branch

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation1.0 h
  • Implementation1.0 h
  • Testing2.0 h
  • Review / QA1.0 h
5.0 hours of engineering $860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,376.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-15033 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-15033 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data