CVE-2025-13457 Information disclosure in WooCommerce Square
Unauthenticated attackers can expose sensitive credit card on file tokens via insecure direct object reference, potentially enabling fraudulent charges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13457?
CVE-2025-13457 is a high-severity vulnerability in WooCommerce Square, published on 10 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.
Weakness: CWE-639
Which versions are affected by CVE-2025-13457?
How do I fix CVE-2025-13457?
No fix has been published for CVE-2025-13457 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13457 being exploited?
There is no known exploitation of CVE-2025-13457 in the wild and no public exploit code.
Sources
Also known as GHSA-8vfw-8f88-jq83.