CVE-2025-13666: Helloprint WordPress Auth Bypass Flaw

CVE-2025-13666 Overview

CVE-2025-13666 is a Missing Authorization vulnerability [CWE-862] in the Helloprint plugin for WordPress, affecting versions up to and including 2.1.2. The plugin registers a public REST API endpoint at /wp-json/helloprint/v1/complete_order_from_helloprint_callback without implementing authorization checks. Unauthenticated attackers can modify WooCommerce order statuses by supplying a valid order reference ID.

The vulnerability enables tampering with the order lifecycle of any WooCommerce store using the affected plugin. This impacts order integrity, potentially allowing unpaid orders to be marked as complete or disrupting normal store operations.

Critical Impact
Unauthenticated attackers can arbitrarily modify WooCommerce order statuses on affected WordPress sites without any credentials.

Affected Products

Helloprint plugin for WordPress, versions up to and including 2.1.2
WordPress sites running WooCommerce with the Helloprint plugin installed
The OrderController.php component within the Helloprint plugin

Discovery Timeline

2025-12-06 - CVE-2025-13666 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13666

Vulnerability Analysis

The Helloprint plugin exposes a REST API endpoint to receive callback notifications about print orders. The endpoint is registered publicly through the WordPress REST API framework but omits the permission_callback verification required to authenticate the caller. As a result, any HTTP client that can reach the WordPress site can invoke the endpoint.

The handler updates WooCommerce order statuses based on the request payload. The only implicit control is knowledge of a valid order reference ID. Order reference IDs are not designed as authentication secrets, so attackers who can enumerate or obtain them can trigger unauthorized state changes.

The issue is classified as CWE-862 (Missing Authorization) and impacts data integrity within the WooCommerce order workflow.

Root Cause

The root cause resides in includes/Base/Controllers/Admin/OrderController.php at line 48, where the REST route registration lacks an authorization check. The plugin treats the callback endpoint as trusted based on the format of the request rather than verifying request authenticity through signatures, shared secrets, or nonces.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /wp-json/helloprint/v1/complete_order_from_helloprint_callback on a vulnerable WordPress site. By supplying a valid order reference identifier, the attacker forces the plugin to update the associated WooCommerce order status. No user interaction, session, or account is required.

See the WordPress plugin source at line 48 and the Wordfence Vulnerability Intel entry for the vulnerable route registration.

Detection Methods for CVE-2025-13666

Indicators of Compromise

HTTP requests to /wp-json/helloprint/v1/complete_order_from_helloprint_callback from unexpected source IP addresses
WooCommerce orders transitioning to completed status without corresponding payment gateway confirmations
REST API access logs showing unauthenticated calls to the Helloprint namespace outside of legitimate integration traffic

Detection Strategies

Inspect web server access logs for requests targeting the helloprint/v1/ REST namespace and correlate with expected Helloprint callback source ranges
Audit WooCommerce order history for status changes that do not match payment processor events or admin actions
Deploy a web application firewall rule to alert on unauthenticated POST or GET requests to the vulnerable endpoint

Monitoring Recommendations

Enable REST API request logging in WordPress and forward logs to a centralized platform for review
Monitor for anomalous spikes in callback endpoint traffic, particularly requests iterating over sequential order identifiers
Track WooCommerce order status transitions and alert on high-volume automated changes

How to Mitigate CVE-2025-13666

Immediate Actions Required

Update the Helloprint plugin to a version released after 2.1.2 that includes the authorization fix, once available
If no patched version is available, deactivate and remove the Helloprint plugin until a fix is released
Review recent WooCommerce order status changes and reconcile them against payment gateway records

Patch Information

At the time of publication, the vulnerability affects versions up to and including 2.1.2. Consult the Wordfence advisory and the Helloprint plugin repository for the latest patched release and fix commits.

Workarounds

Block external access to the /wp-json/helloprint/v1/complete_order_from_helloprint_callback endpoint at the web server or WAF layer, allowing only Helloprint's official callback IP ranges
Restrict WordPress REST API access using authentication plugins or .htaccess rules where the Helloprint integration is not required
Implement rate limiting on the WordPress REST API to reduce feasibility of order reference ID enumeration

bash

# Example nginx rule restricting the vulnerable endpoint by source IP
location ~ ^/wp-json/helloprint/v1/complete_order_from_helloprint_callback {
    allow  <HELLOPRINT_CALLBACK_IP>;
    deny   all;
}