CVE-2025-12584 Overview
CVE-2025-12584 affects the Quick View for WooCommerce plugin for WordPress in all versions up to and including 2.2.17. The vulnerability resides in the wqv_popup_content AJAX endpoint, which applies insufficient restrictions on which products can be included in responses. Unauthenticated attackers can query the endpoint and extract data from private WooCommerce products that should not be publicly accessible. The flaw is classified under CWE-200: Information Exposure and requires no authentication or user interaction to exploit over the network.
Critical Impact
Unauthenticated remote attackers can retrieve content from private WooCommerce products on any WordPress site running a vulnerable version of the Quick View for WooCommerce plugin.
Affected Products
- Quick View for WooCommerce plugin for WordPress, versions up to and including 2.2.17
- WordPress installations running WooCommerce with the affected plugin enabled
- Sites relying on WooCommerce private product visibility for confidential listings
Discovery Timeline
- 2025-11-27 - CVE-2025-12584 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12584
Vulnerability Analysis
The Quick View for WooCommerce plugin exposes a quick-view popup feature through the wqv_popup_content AJAX action. This handler is registered for unauthenticated visitors so anonymous shoppers can preview products from listing pages. The handler accepts a product identifier supplied by the caller and returns rendered product content in the response.
The endpoint does not verify whether the requested product is intended to be publicly visible. WooCommerce supports product visibility settings including private, which restricts a product to authorized users. The AJAX handler skips these checks and returns content for any product ID an attacker submits. An unauthenticated attacker can enumerate product IDs and read data belonging to non-public listings.
Because the disclosure is limited to product content and does not permit modification, the vulnerability impacts confidentiality only. There is no integrity or availability impact reported.
Root Cause
The root cause is a missing authorization check in the AJAX callback bound to wqv_popup_content. The plugin trusts the client-supplied product identifier and renders the associated product without validating the product's post_status or visibility taxonomy. This is a classic broken access control pattern combined with information exposure (CWE-200).
Attack Vector
An attacker sends an unauthenticated HTTP POST request to wp-admin/admin-ajax.php on the target site, specifying action=wqv_popup_content and a target product ID. The server returns rendered content of the referenced product regardless of its visibility state. Attackers can iterate through product IDs to enumerate and extract private product data at scale.
The vulnerability manifests entirely in the AJAX handler registration and its rendering logic. Refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Report for the specific code changes applied by the vendor.
Detection Methods for CVE-2025-12584
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=wqv_popup_content
- Sequential or high-volume requests targeting incrementing product IDs from a single source
- Responses returning product content for items whose post_status is private
- Access log entries with anonymous sessions triggering the wqv_popup_content action outside normal browsing patterns
Detection Strategies
- Inspect web server access logs for requests to admin-ajax.php referencing the wqv_popup_content action from unauthenticated clients.
- Correlate request bursts against the same endpoint with enumeration patterns across product ID ranges.
- Compare returned product identifiers against the WooCommerce catalog to identify responses that leak private listings.
Monitoring Recommendations
- Deploy a web application firewall rule that inspects action=wqv_popup_content requests and enforces authentication or rate limits.
- Enable WordPress and WooCommerce audit logging to record product access events, including AJAX-based views.
- Alert on anomalous outbound response sizes from admin-ajax.php associated with the affected action name.
How to Mitigate CVE-2025-12584
Immediate Actions Required
- Update the Quick View for WooCommerce plugin to a version later than 2.2.17 that includes the vendor's patched changeset.
- Audit WooCommerce products with private visibility to determine whether any sensitive data may have been exposed.
- Review web server access logs for prior requests to the wqv_popup_content action and identify potential enumeration activity.
Patch Information
The plugin author addressed the flaw in a WordPress.org changeset for the woo-quickview repository. Administrators should upgrade to the fixed release referenced in the WordPress Plugin Changeset and confirmed in the Wordfence Vulnerability Report. Verify the installed version in the WordPress admin plugins screen after upgrading.
Workarounds
- Deactivate the Quick View for WooCommerce plugin until it can be updated to a patched version.
- Restrict access to admin-ajax.php for the wqv_popup_content action via a web application firewall or mod_security rule.
- Temporarily change private products to draft status so the plugin cannot render their content.
# Example WAF rule blocking anonymous access to the vulnerable action
SecRule ARGS:action "@streq wqv_popup_content" \
"id:1012584,phase:2,deny,status:403,log,\
msg:'Block CVE-2025-12584 Quick View for WooCommerce info exposure'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
