CVE-2025-24625 Overview
CVE-2025-24625 is a Missing Authorization vulnerability [CWE-862] in the Taxonomy/Term and Role based Discounts for WooCommerce plugin by Marco Almeida | Webdados. The flaw affects all versions up to and including 5.1 of the taxonomy-discounts-woocommerce WordPress plugin. The issue stems from incorrectly configured access control on plugin settings endpoints, chained with a Cross-Site Request Forgery (CSRF) vector. An attacker can trick an authenticated administrator into submitting a forged request that changes plugin settings without proper authorization checks.
Critical Impact
Successful exploitation lets attackers alter WooCommerce discount configurations through CSRF, requiring only that an authenticated user visit an attacker-controlled page.
Affected Products
- Taxonomy/Term and Role based Discounts for WooCommerce plugin (taxonomy-discounts-woocommerce)
- All versions from n/a through 5.1
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-01-24 - CVE-2025-24625 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24625
Vulnerability Analysis
The plugin exposes settings-modification functionality without enforcing proper authorization or anti-CSRF token validation. Requests that alter plugin configuration do not verify that the submitter intended the action, nor do they confirm the requester has the required capability check beyond session presence. An attacker can craft a malicious HTML page that issues a state-changing request to the vulnerable WordPress endpoint. When an authenticated administrator loads the page, the browser transmits the request with valid session cookies, and the plugin accepts and applies the changes.
The vulnerability requires user interaction, which limits automated exploitation but suits targeted phishing and watering-hole scenarios. The impact is scoped to integrity of plugin settings and possible availability disruption to discount logic on the storefront.
Root Cause
The root cause is missing authorization enforcement on privileged actions. The plugin does not validate a WordPress nonce (wp_verify_nonce) or verify the acting user's capability with current_user_can() before applying settings changes. This maps to CWE-862: Missing Authorization.
Attack Vector
Exploitation follows a standard CSRF pattern against a WordPress admin. The attacker hosts a page containing a hidden form or JavaScript that submits a POST request to the plugin's settings handler within the target WordPress site. The victim, already authenticated as an administrator in another tab, visits the attacker page. The browser attaches session cookies to the cross-origin request, and the plugin processes the settings change as if it were legitimate.
For technical details on the request structure, see the Patchstack advisory for CVE-2025-24625.
Detection Methods for CVE-2025-24625
Indicators of Compromise
- Unexpected modifications to WooCommerce taxonomy or role-based discount configuration entries in the wp_options table.
- HTTP POST requests to the plugin's admin settings endpoints originating from external Referer headers.
- Administrator sessions producing settings changes shortly after visiting external links or opening email content.
Detection Strategies
- Review WordPress access logs for POST requests to wp-admin endpoints tied to taxonomy-discounts-woocommerce with mismatched or absent Referer values.
- Enable WordPress audit logging plugins to record settings changes with actor, timestamp, and originating IP.
- Correlate discount configuration diffs against known change-management windows to surface unauthorized edits.
Monitoring Recommendations
- Alert on any modification to plugin settings outside of scheduled administrative activity.
- Monitor administrator browser sessions for cross-site request patterns hitting /wp-admin/admin.php or /wp-admin/options.php.
- Track plugin version inventory across WordPress properties to identify hosts still running version 5.1 or earlier.
How to Mitigate CVE-2025-24625
Immediate Actions Required
- Identify all WordPress installations running Taxonomy/Term and Role based Discounts for WooCommerce at version 5.1 or earlier.
- Update the plugin to the latest version released by Marco Almeida | Webdados that addresses CVE-2025-24625.
- Force re-authentication for administrator accounts and rotate credentials on affected sites if unauthorized settings changes are found.
Patch Information
Refer to the Patchstack advisory for CVE-2025-24625 for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by deploying the vendor-provided package.
Workarounds
- Deactivate and remove the plugin until a patched version is deployed.
- Restrict WordPress admin access using IP allowlists or a web application firewall to limit CSRF exposure.
- Require administrators to use separate browsers or isolated sessions for WordPress management to reduce cross-site cookie exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
