CVE-2025-12955: WooCommerce Plugin Info Disclosure Flaw

CVE-2025-12955 Overview

The Live Sales Notification for WooCommerce plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) in all versions up to and including 2.3.39. The vulnerability exists because the getOrders function lacks proper authorization and capability checks when the plugin is configured to display recent order information. This security flaw enables unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.

Critical Impact

Unauthenticated attackers can access sensitive customer order data without any authentication, potentially leading to privacy violations and data breach regulatory consequences.

Affected Products

• Live Sales Notification for WooCommerce plugin for WordPress versions up to and including 2.3.39
• WordPress installations using the vulnerable plugin with recent order display functionality enabled

Discovery Timeline

• 2025-11-18 - CVE-2025-12955 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12955

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), a configuration and design flaw where the application fails to perform adequate access control checks before granting access to protected resources. In this case, the getOrders function within the Live Sales Notification for WooCommerce plugin does not verify whether the requesting user has the appropriate permissions or capabilities to access order information.

When the plugin is configured to display recent order notifications, it exposes an endpoint or function that can be called without authentication. The lack of proper capability checks means that any user—including anonymous, unauthenticated visitors—can invoke the getOrders function and retrieve order data that should only be accessible to authorized administrators or shop managers.

The exposed data includes personally identifiable information (PII) such as customer first names, geographic location details (city, state, country), timestamps of purchases, and details about what products were ordered. This information could be leveraged for social engineering attacks, competitor intelligence gathering, or further targeted attacks against customers.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the getOrders function implementation. WordPress plugins should utilize capability checks via functions like current_user_can() to verify that the requesting user has appropriate permissions before returning sensitive data. The vulnerable versions of this plugin fail to implement such checks, allowing the function to return order data regardless of the requester's authentication status or role.

Attack Vector

The attack vector for CVE-2025-12955 is network-based, requiring no authentication, no user interaction, and low attack complexity. An attacker can exploit this vulnerability remotely by simply making requests to the vulnerable endpoint. Since no special privileges are required and the attack does not depend on any user action, exploitation is straightforward.

A malicious actor could enumerate order information by repeatedly calling the vulnerable function, potentially scraping large amounts of customer data from the target WooCommerce store. This data exfiltration can occur without leaving obvious traces in standard application logs, as the requests would appear similar to legitimate plugin functionality.

The vulnerability is limited to information disclosure (confidentiality impact) and does not directly allow modification of data (no integrity impact) or service disruption (no availability impact). However, the exposed customer information could enable subsequent attacks or result in significant privacy and compliance violations.

Detection Methods for CVE-2025-12955

Indicators of Compromise

• Unusual or excessive requests to WooCommerce order-related endpoints from unauthenticated sources
• Multiple requests from the same IP address or user agent attempting to access order data
• Unexpected access patterns to the Live Sales Notification plugin's AJAX handlers
• Web server logs showing repeated calls to getOrders functionality without corresponding authenticated sessions

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and rate-limit requests to the plugin's endpoints
• Review WordPress access logs for unauthenticated requests targeting WooCommerce order information
• Deploy intrusion detection systems (IDS) configured to alert on suspicious data extraction patterns
• Enable WordPress debug logging temporarily to identify unauthorized function calls

Monitoring Recommendations

• Monitor outbound data transfer volumes from the WordPress server for anomalies
• Set up alerting for bulk access to customer order information outside normal administrative workflows
• Implement real-time log analysis for the WordPress installation focusing on plugin-related activity
• Track failed and successful authentication attempts around WooCommerce administrative areas

How to Mitigate CVE-2025-12955

Immediate Actions Required

• Update the Live Sales Notification for WooCommerce plugin to the latest patched version immediately
• If unable to update immediately, deactivate the plugin until a patch can be applied
• Review WordPress access logs to determine if the vulnerability has been exploited
• Notify affected customers if evidence of data access is discovered

Patch Information

The vulnerability has been addressed in versions after 2.3.39. The patch details can be found in the WordPress Plugin Change Log. Additional technical information about the vulnerability is available in the Wordfence Vulnerability Report.

Site administrators should update to the latest version of the plugin which includes proper authorization checks in the getOrders function.

Workarounds

• Temporarily disable the "display recent order information" feature in the plugin settings if updates cannot be immediately applied
• Implement a web application firewall rule to block unauthenticated access to the plugin's AJAX endpoints
• Use WordPress security plugins to add additional access control layers to sensitive endpoints
• Consider using server-level access controls to restrict access to the vulnerable functionality until patching is complete

# Example: Restrict access to plugin AJAX endpoint via .htaccess
# Add to WordPress .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} live-sales-notifications-for-woocommerce [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>