CVE-2025-15033 Overview
CVE-2025-15033 is an information disclosure vulnerability in WooCommerce, the widely deployed WordPress e-commerce plugin. The flaw allows logged-in customers to access order data belonging to guest customers on stores with specific configurations. Affected versions span WooCommerce 8.1 through 10.4.2, with WooCommerce 8.0 and earlier unaffected. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated customer accounts can retrieve personal and order details of guest shoppers, exposing names, addresses, and purchase history stored in the store database.
Affected Products
- WooCommerce versions 8.1 through 8.1.2
- WooCommerce versions 8.2 through 10.4.2 (across the 8.x, 9.x, and 10.x branches)
- WordPress sites running WooCommerce with guest checkout enabled in the affected configuration
Discovery Timeline
- 2025-12-22 - CVE-2025-15033 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-15033
Vulnerability Analysis
The vulnerability stems from insufficient authorization checks when a logged-in customer requests order data associated with guest checkouts. WooCommerce stores guest orders without linking them to a registered user account. On sites with a specific configuration, the plugin returns guest order records to authenticated customer sessions that should not have access to those records.
Exploitation requires only a low-privilege authenticated account, such as a standard customer registration on the target store. The attacker interacts with the store over the network through normal WooCommerce endpoints. Successful exploitation discloses order details including customer names, billing and shipping addresses, product line items, and order totals. Integrity and availability of the store are not affected.
Root Cause
The root cause is a broken access control condition [CWE-200] in the order lookup logic. WooCommerce does not correctly validate that the requesting user owns the order being retrieved when the order originates from a guest checkout. The condition is present from the 8.1 release forward and is not exposed in 8.0 or earlier, indicating a regression introduced during the 8.1 development cycle.
Attack Vector
An attacker registers a customer account on a vulnerable WooCommerce store. The attacker then issues authenticated requests to the order-viewing surface of the store. On sites with the vulnerable configuration, the store returns guest order data instead of restricting the response to orders owned by the authenticated user. No user interaction from the guest customer is required, and no elevated privileges are needed on the WordPress site.
See the WPScan Vulnerability Report for additional technical detail on the affected code paths.
Detection Methods for CVE-2025-15033
Indicators of Compromise
- Unusual volumes of order-detail requests from a single authenticated customer account against WooCommerce endpoints such as /my-account/view-order/ or the WooCommerce REST API
- Access to order identifiers that do not correspond to purchases made by the requesting account
- Customer accounts created shortly before enumeration activity against sequential order IDs
Detection Strategies
- Review WooCommerce and WordPress access logs for authenticated sessions requesting many distinct order IDs in short time windows
- Correlate order-view requests with the _customer_user meta value of the target order to identify mismatches between requesting user and order owner
- Inspect the WooCommerce REST API audit trail for orders endpoint calls returning guest orders to non-admin users
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized logging platform and alert on rapid sequential order ID access patterns
- Track newly registered customer accounts that immediately query multiple orders
- Monitor for anomalous data exfiltration volumes from WooCommerce order endpoints
How to Mitigate CVE-2025-15033
Immediate Actions Required
- Upgrade WooCommerce to version 10.4.3 or to the corresponding fixed point release on the branch currently deployed
- Audit customer accounts registered during the exposure window and review order-view activity for unauthorized access
- Notify affected guest customers if log analysis confirms disclosure of their order records
Patch Information
Automattic released fixes across every affected branch. WooCommerce 10.4.3 contains the primary fix, and point releases starting at 8.1.3 deliver the patch to earlier maintained branches. Store operators should apply the smallest upgrade that resolves the issue for their current branch to minimize regression risk. Refer to the WPScan Vulnerability Report for the full list of fixed versions.
Workarounds
- Disable guest checkout in WooCommerce settings under WooCommerce > Settings > Accounts & Privacy until the patch is applied
- Restrict access to the my-account order history views through a temporary web application firewall rule while patching is scheduled
- Reduce the sensitivity of exposed data by limiting the fields returned by custom WooCommerce order endpoints
# Update WooCommerce using WP-CLI on the affected site
wp plugin update woocommerce --version=10.4.3
wp plugin list --name=woocommerce --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
