Read the docs
TI-2025-12304 Aliases CVE-2025-13457GHSA-8vfw-8f88-jq83

Authorization bypass in WooCommerce Square

Priority LOW 39CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed WooCommerce Square (woocommerce): 4.2.3, 4.3.2, 4.4.2 +7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WooCommerceWooCommerce Square4.2.0 to before 4.2.3; 4.3.0 to before 4.3.2; 4.4.0 to before 4.4.2; 4.5.0 to before 4.5.2; 4.6.0 to before 4.6.4; 4.7.0 to before 4.7.4; 4.8.0 to before 4.8.8; 4.9.0 to before 4.9.9; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.24.2.3, 4.3.2, 4.4.2, 4.5.2, 4.6.4, 4.7.4, 4.8.8, 4.9.9, 5.0.1, 5.1.2Patch availableCNA
  • WooCommerce Square VendorWooCommerce Affected 4.2.0 to before 4.2.3; 4.3.0 to before 4.3.2; 4.4.0 to before 4.4.2; 4.5.0 to before 4.5.2; 4.6.0 to before 4.6.4; 4.7.0 to before 4.7.4; 4.8.0 to before 4.8.8; 4.9.0 to before 4.9.9; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.2 Fixed in 4.2.3, 4.3.2, 4.4.2, 4.5.2, 4.6.4, 4.7.4, 4.8.8, 4.9.9, 5.0.1, 5.1.2 Patch available CNA

Remediation

  • Fix · CNA WooCommerce Square (woocommerce) Fixed in 4.2.3, 4.3.2, 4.4.2, 4.5.2, 4.6.4, 4.7.4, 4.8.8, 4.9.9, 5.0.1, 5.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13457
  2. 2026-10-03 Alias added: GHSA-8vfw-8f88-jq83

References

Other 2

  • TI-2023-03274 WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2023-03273 WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2023-02044 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update CVSS 3.1MEDIUM 6.5
  • TI-2022-00684 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVSS 3.1MEDIUM 4.3
  • TI-2021-06504 WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2023-17950 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
See all 88 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences