CVE-2025-13441: WooCommerce Plugin Auth Bypass Flaw

CVE-2025-13441 Overview

CVE-2025-13441 affects the Hide Category by User Role for WooCommerce plugin for WordPress in all versions up to and including 2.3.1. The plugin is vulnerable to Missing Authorization [CWE-862] due to a missing capability check on the admin_init hook that executes wp_cache_flush(). Unauthenticated attackers can flush the site's object cache via forged requests, potentially degrading site performance. The issue carries a CVSS score of 5.3 and impacts integrity of cached data without requiring authentication or user interaction.

Critical Impact

Unauthenticated attackers can repeatedly trigger wp_cache_flush() on affected WordPress sites, forcing cache rebuilds and degrading site performance under sustained requests.

Affected Products

• Hide Category by User Role for WooCommerce plugin for WordPress — all versions through 2.3.1
• WordPress sites running WooCommerce with the affected plugin installed
• Sites relying on WordPress object caching for performance

Discovery Timeline

• 2025-11-27 - CVE-2025-13441 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13441

Vulnerability Analysis

The vulnerability resides in the plugin's administrative initialization logic within admin/admin-ui-setup.php. The plugin registers a handler on the WordPress admin_init hook that calls wp_cache_flush() without verifying whether the requester has the required capability or providing a valid nonce. Because admin_init fires on every request to /wp-admin/, including admin-ajax.php and admin-post.php, unauthenticated visitors reach the hook and trigger the cache flush.

The practical impact is limited to availability degradation of cached content. Flushing the object cache forces WordPress to regenerate cached queries, transients, and options from the database. Repeated forged requests can amplify database load and slow page rendering, particularly on high-traffic WooCommerce storefronts.

Root Cause

The root cause is a Missing Authorization flaw [CWE-862]. The plugin's admin_init handler omits both a current_user_can() capability check and a nonce verification. Any HTTP client that reaches a /wp-admin/ endpoint triggers the cache-flush code path regardless of authentication state.

Attack Vector

An attacker sends an unauthenticated HTTP request to any /wp-admin/ endpoint that fires admin_init without requiring a session, such as admin-post.php or admin-ajax.php with unauthenticated actions. The forged request executes wp_cache_flush() and clears the object cache. Repeating the request at scale produces a low-cost denial-of-cache condition. Full technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Code.

Detection Methods for CVE-2025-13441

Indicators of Compromise

• Repeated unauthenticated HTTP requests to /wp-admin/admin-post.php or /wp-admin/admin-ajax.php from single or rotating source addresses.
• Spikes in database query volume immediately following bursts of /wp-admin/ requests without corresponding authenticated sessions.
• Object cache hit-ratio drops observed in Redis, Memcached, or other backend metrics without a corresponding administrative action.

Detection Strategies

• Correlate web-server access logs for anonymous /wp-admin/ requests with backend cache metrics to identify forced flushes.
• Deploy WordPress security plugins that log unauthenticated hits to admin endpoints and flag anomalous request rates.
• Review the installed plugin inventory for hide-category-by-user-role-for-woocommerce at version 2.3.1 or earlier.

Monitoring Recommendations

• Alert on sustained cache-flush events or object-cache miss surges outside of deployment windows.
• Monitor 200-response volumes on admin-post.php and admin-ajax.php from unauthenticated clients.
• Track database CPU and query-per-second metrics for anomalies aligned with /wp-admin/ traffic patterns.

How to Mitigate CVE-2025-13441

Immediate Actions Required

• Update the Hide Category by User Role for WooCommerce plugin to a version later than 2.3.1 as soon as a fixed release is available.
• Audit /wp-admin/ access logs for evidence of unauthenticated exploitation attempts.
• Restrict access to /wp-admin/ at the web-server or WAF layer to trusted networks where operationally feasible.

Patch Information

At the time of publication, refer to the WordPress Plugin Changeset History for the current fix status. Administrators should verify that the deployed plugin version adds a current_user_can() capability check and nonce verification around the wp_cache_flush() call before treating the site as remediated.

Workarounds

• Deactivate and remove the plugin until a patched version is installed if the site can operate without the category-hiding feature.
• Apply web application firewall rules that block unauthenticated requests to admin-post.php and admin-ajax.php for actions associated with the plugin.
• Rate-limit anonymous requests to /wp-admin/ endpoints at the reverse proxy to blunt automated abuse.

# Example: nginx rate-limit for unauthenticated /wp-admin/ access
limit_req_zone $binary_remote_addr zone=wpadmin:10m rate=5r/m;

location ~* ^/wp-admin/ {
    limit_req zone=wpadmin burst=10 nodelay;
    # Allow trusted admin networks
    allow 203.0.113.0/24;
    deny all;
}