CVE-2025-15484 Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass
Unauthenticated attackers can bypass permission checks to read and modify store resources like products and customers in the Order Notification for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15484?
CVE-2025-15484 is a critical authentication bypass vulnerability in Unknown Order Notification for WooCommerce, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
Weakness: CWE-287
Which versions are affected by CVE-2025-15484?
How do I fix CVE-2025-15484?
No fix has been published for CVE-2025-15484 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-15484 being exploited?
There is no known exploitation of CVE-2025-15484 in the wild and no public exploit code.
Sources
Also known as GHSA-9h28-9gg8-2pm4.