CVE-2025-12955 Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure
Unauthenticated attackers can extract sensitive customer data via the getOrders function when the plugin is configured to display recent orders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12955?
CVE-2025-12955 is a high-severity missing authorization vulnerability in rajeshsingh520 PiWeb Live sales notification for WooCommerce, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.
Weakness: CWE-862
Which versions are affected by CVE-2025-12955?
How do I fix CVE-2025-12955?
No fix has been published for CVE-2025-12955 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12955 being exploited?
There is no known exploitation of CVE-2025-12955 in the wild and no public exploit code.
Sources
Also known as GHSA-5f3g-c8jf-rw88.