CVE-2025-1284: WooCommerce Order Printing IDOR Vulnerability

CVE-2025-1284 Overview

CVE-2025-1284 is an Insecure Direct Object Reference (IDOR) vulnerability in the WooCommerce Automatic Order Printing plugin (formerly WooCommerce Google Cloud Print) for WordPress. The flaw affects all versions up to and including 4.1. It resides in the xc_woo_printer_preview AJAX action, which fails to validate a user-controlled key. Authenticated attackers with Subscriber-level access or higher can view invoices and orders belonging to other users. These documents can contain personally identifiable information (PII), billing details, and purchase histories. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can enumerate order IDs and read invoices belonging to other customers, exposing sensitive order and billing information.

Affected Products

WooCommerce Automatic Order Printing plugin for WordPress
Formerly known as WooCommerce Google Cloud Print
All versions up to and including 4.1

Discovery Timeline

2025-04-24 - CVE-2025-1284 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1284

Vulnerability Analysis

The plugin exposes an AJAX endpoint named xc_woo_printer_preview used to render a preview of an order invoice. The handler accepts an order identifier from the client and returns the corresponding invoice contents. It does not verify that the requesting user owns the referenced order or holds a role authorized to view it.

This pattern is a textbook Insecure Direct Object Reference. The server trusts a client-supplied key as an authorization decision. Because WordPress permits Subscriber-level accounts to authenticate to admin-ajax endpoints, any registered user of the site can iterate over sequential order IDs and retrieve invoice previews. Sites with open registration or WooCommerce checkout account creation are particularly exposed.

Root Cause

The root cause is missing authorization logic in the xc_woo_printer_preview AJAX callback. The code path does not call current_user_can() against the specific order, nor does it compare the order's customer ID against the current user. Nonce verification alone, if present, does not solve the issue because any authenticated user can obtain a valid nonce.

Attack Vector

An attacker registers or logs in with a Subscriber account. They then send a POST request to /wp-admin/admin-ajax.php with action=xc_woo_printer_preview and an arbitrary order identifier. The server returns the target order's invoice HTML. By incrementing the order ID, the attacker can enumerate the store's entire order history and harvest customer data.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-1284

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php containing action=xc_woo_printer_preview from a single authenticated session.
Sequential or high-cardinality order ID parameters submitted to the same endpoint within a short time window.
Subscriber-role accounts generating admin-ajax traffic volumes inconsistent with normal shopper behavior.

Detection Strategies

Parse WordPress access logs for the xc_woo_printer_preview action parameter and correlate with the authenticated user role.
Alert when a single user accesses more than a small threshold of distinct order IDs through the preview endpoint.
Review WooCommerce order access audit trails, if enabled, for reads originating outside admin or shop-manager sessions.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule to log and rate-limit calls to xc_woo_printer_preview.
Forward WordPress and web server logs to a centralized analytics or SIEM platform for cross-session correlation.
Monitor account registration activity for spikes that may precede enumeration attempts.

How to Mitigate CVE-2025-1284

Immediate Actions Required

Update the WooCommerce Automatic Order Printing plugin to a version later than 4.1 as soon as the vendor publishes a fixed release.
Restrict or disable open WordPress account registration on production storefronts where it is not required.
Audit existing Subscriber accounts and remove those created by unknown or suspicious sources.

Patch Information

At the time of the last NVD update on 2026-06-17, the vendor listing on CodeCanyon is the authoritative source for updated releases. Site operators should confirm they are running a version higher than 4.1 that explicitly addresses CVE-2025-1284. Consult the Wordfence Vulnerability Report for the latest patch status.

Workarounds

Deactivate the WooCommerce Automatic Order Printing plugin until a patched version is installed.
Deploy a WAF rule that blocks unauthenticated and non-administrative requests to the xc_woo_printer_preview AJAX action.
Add a server-side authorization check via a must-use plugin that validates the current user owns the requested order before the plugin handler executes.

bash

# Example WAF rule (ModSecurity) to block low-privilege access to the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002025,msg:'Block CVE-2025-1284 IDOR attempt'"
  SecRule ARGS:action "@streq xc_woo_printer_preview" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"