CVE-2025-23766: OPSI Israel Auth Bypass Vulnerability

CVE-2025-23766 Overview

CVE-2025-23766 is a Missing Authorization vulnerability [CWE-862] affecting the ashamil OPSI Israel Domestic Shipments plugin (woo-ups-pickup) for WordPress. The flaw stems from incorrectly configured access control security levels that allow unauthenticated network attackers to invoke plugin functionality without proper permission checks. All plugin versions up to and including 2.8.2 are affected. The vulnerability requires no privileges and no user interaction, and it can be exploited over the network.

Critical Impact
Unauthenticated attackers can exploit broken access control in the woo-ups-pickup plugin to modify shipment-related data and degrade WooCommerce store integrity and availability.

Affected Products

ashamil OPSI Israel Domestic Shipments (woo-ups-pickup) plugin for WordPress
All versions from n/a through 2.8.2
WooCommerce sites integrating the plugin for Israel domestic shipping

Discovery Timeline

2025-02-14 - CVE-2025-23766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23766

Vulnerability Analysis

The plugin exposes one or more actions that lack a capability or nonce check before performing privileged operations. Because these endpoints do not verify the caller's role or intent, any unauthenticated visitor can reach them over the network. The result is a broken access control condition classified under [CWE-862] Missing Authorization. Exploitation impacts integrity and availability of shipment data while confidentiality is not directly affected. The EPSS probability is 0.389% at the 31.3 percentile at the time of last enrichment.

Root Cause

The root cause is the absence of authorization checks such as current_user_can() and nonce verification via check_admin_referer() or wp_verify_nonce() on plugin action handlers. WordPress plugins that register AJAX or admin-post hooks must gate sensitive callbacks with capability checks. In woo-ups-pickup versions through 2.8.2, these gates are missing or misconfigured, exposing internal handlers to any caller.

Attack Vector

An attacker sends crafted HTTP requests directly to the plugin's exposed endpoints, such as admin-ajax.php action handlers or admin-post routes. No authentication or user interaction is required. The attacker can trigger plugin operations reserved for authorized store operators, altering pickup or shipment configuration and disrupting order processing. See the Patchstack Vulnerability Report for advisory details.

No public proof-of-concept code has been published for this issue. Verified exploitation code is therefore not included here.

Detection Methods for CVE-2025-23766

Indicators of Compromise

Unexpected POST or GET requests to wp-admin/admin-ajax.php referencing woo-ups-pickup actions from unauthenticated sessions.
Unauthorized modifications to WooCommerce shipment, pickup point, or plugin option records with no matching administrator login.
Requests to plugin admin-post endpoints from external IP addresses without a valid wordpress_logged_in_* cookie.

Detection Strategies

Inspect web server access logs for requests targeting plugin action names originating from anonymous clients.
Correlate WooCommerce audit trails against WordPress user session activity to surface actions performed without an authenticated user.
Deploy a web application firewall rule that flags requests to woo-ups-pickup handlers lacking a valid nonce parameter.

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and admin-post handlers registered by the plugin.
Monitor plugin option tables (wp_options) and shipment metadata for unexpected writes.
Alert on outbound HTTP anomalies from the WooCommerce host that may indicate follow-on abuse after data tampering.

How to Mitigate CVE-2025-23766

Immediate Actions Required

Identify all WordPress installations running the woo-ups-pickup plugin at version 2.8.2 or earlier.
Deactivate the plugin until a vendor-supplied patched version can be validated and deployed.
Restrict access to wp-admin and admin-ajax.php by IP allowlist where feasible.
Rotate WordPress administrator credentials and audit recent shipment configuration changes.

Patch Information

At the time of publication, the NVD entry lists affected versions through <= 2.8.2 and references the Patchstack Vulnerability Report. Administrators should upgrade to the latest release published by the vendor after 2.8.2 that explicitly resolves the Missing Authorization issue.

Workarounds

Block external requests to plugin AJAX and admin-post actions via web application firewall rules until the plugin is updated.
Enforce authentication on admin-ajax.php at the reverse proxy layer for non-public actions.
Remove the plugin entirely if Israel domestic shipping integration is not required for current operations.

bash

# Example: WAF rule concept to block unauthenticated woo-ups-pickup actions
# Adapt to your WAF syntax (ModSecurity shown for illustration)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002376,msg:'Block unauth woo-ups-pickup action'"
  SecRule ARGS:action "@rx ^(woo_ups_pickup|opsi_).*" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"