CVE-2025-11741: WooCommerce Quick View Info Disclosure Flaw

CVE-2025-11741 Overview

CVE-2025-11741 affects the WPC Smart Quick View for WooCommerce plugin for WordPress in all versions up to and including 4.2.5. The vulnerability exists in the woosq_quickview AJAX endpoint, which fails to enforce restrictions on which posts can be included in quick view responses. Unauthenticated attackers can exploit this flaw to extract data from password-protected, private, or draft products they should not be able to view. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can retrieve contents of password-protected, private, and draft WooCommerce products by manipulating the woosq_quickview AJAX request.

Affected Products

WPC Smart Quick View for WooCommerce plugin for WordPress
All versions up to and including 4.2.5
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-10-18 - CVE-2025-11741 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-11741

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) affecting the WooCommerce quick view functionality. The woosq_quickview AJAX handler accepts a product identifier from client input and returns product content without validating the requesting user's authorization to view that specific post. Because the endpoint is registered for unauthenticated visitors, any attacker can query arbitrary product IDs. This includes posts marked as private, saved as drafts, or protected by a password, bypassing the standard WordPress visibility and access-control model.

The returned payload can include product titles, descriptions, images, prices, and related metadata that site operators expected to remain hidden. Confidentiality is affected while integrity and availability are not, which aligns with the disclosure-only nature of this flaw. The EPSS probability of exploitation stands at 0.313%.

Root Cause

The root cause is insufficient authorization checks inside the woosq_quickview AJAX endpoint. The handler resolves posts by ID and renders their contents without calling authorization primitives such as current_user_can() or verifying post_status and post_password conditions. This is a classic broken access control pattern where the object reference alone determines the response.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with action=woosq_quickview and an arbitrary numeric product ID. The plugin returns the post's contents in the response body regardless of the post's status or password protection. Attackers can enumerate product IDs sequentially to harvest unpublished catalog data, price sheets, or pre-launch product information at scale.

Refer to the Wordfence Vulnerability Report and the WordPress Changeset Update for the applied patch details.

Detection Methods for CVE-2025-11741

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=woosq_quickview with sequential or enumerated product IDs.
Access log spikes from a single source IP requesting many distinct product IDs in a short window.
HTTP 200 responses returning content for posts whose status is private, draft, or password-protected.

Detection Strategies

Inspect web server and WAF logs for repeated woosq_quickview calls without an authenticated session cookie.
Correlate AJAX endpoint traffic against the WordPress posts table to flag responses for non-published post_status values.
Deploy virtual patching rules on the WAF to block unauthenticated calls to woosq_quickview until the plugin is updated.

Monitoring Recommendations

Alert on anomalous request rates to admin-ajax.php from single IPs or user agents.
Track outbound response sizes on woosq_quickview calls to identify data extraction patterns.
Review WordPress audit logs for changes to unpublished products following suspicious AJAX activity.

How to Mitigate CVE-2025-11741

Immediate Actions Required

Update the WPC Smart Quick View for WooCommerce plugin to a version later than 4.2.5 as soon as a fixed release is available.
Audit WooCommerce catalog for exposure of draft, private, or password-protected products that may have been accessed.
Restrict access to admin-ajax.php at the WAF layer for the woosq_quickview action from unauthenticated sources.

Patch Information

The vendor released a fix documented in the WordPress plugin changeset 3379189. Administrators should upgrade through the WordPress plugin management interface and confirm the installed version is above 4.2.5.

Workarounds

Temporarily deactivate the WPC Smart Quick View for WooCommerce plugin until the update is applied.
Add a WAF rule to block requests containing action=woosq_quickview when no authenticated WordPress session cookie is present.
Move sensitive unpublished products out of the WooCommerce catalog until remediation is confirmed.

bash

# Example ModSecurity rule to block unauthenticated woosq_quickview requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1011741,msg:'Block CVE-2025-11741 woosq_quickview access'"
    SecRule ARGS:action "@streq woosq_quickview" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"