CVE-2025-29006: WooCommerce Direct Checkout Auth Bypass

CVE-2025-29006 Overview

CVE-2025-29006 is a Missing Authorization vulnerability [CWE-862] affecting the centangle Direct Checkout for WooCommerce Lite WordPress plugin (woo-direct-checkout-lite). The flaw affects all versions up through 1.0.3 and allows unauthenticated network-based attackers to access plugin functionality that is not properly constrained by access control lists (ACLs). Because the plugin extends WooCommerce checkout behavior on e-commerce sites, exposed endpoints can be abused to modify plugin-controlled state without valid authorization.

Critical Impact
An unauthenticated remote attacker can invoke plugin functionality intended for privileged users, resulting in integrity impact to WooCommerce store configuration or checkout behavior.

Affected Products

centangle Direct Checkout for WooCommerce Lite (woo-direct-checkout-lite)
All versions from n/a through <= 1.0.3
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2025-06-06 - CVE-2025-29006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29006

Vulnerability Analysis

The vulnerability is a Broken Access Control issue classified under [CWE-862] Missing Authorization. The plugin exposes one or more actions that fail to verify whether the requesting user holds the required capability or role before executing privileged logic. An attacker sends an HTTP request over the network without authentication and without user interaction to reach the vulnerable handler.

Exploitation results in an integrity impact on the WordPress site. Confidentiality and availability are not directly affected according to the published CVSS vector. The EPSS data indicates a low observed exploitation probability at this time, but WordPress plugin authorization flaws are routinely scanned for at scale.

Root Cause

The root cause is the absence of a capability check inside plugin request handlers. In WordPress plugins, functions bound to admin-post.php, admin-ajax.php, or REST routes must call current_user_can() and validate a nonce via check_admin_referer() or wp_verify_nonce(). The affected handlers omit these guardrails, so any HTTP client can invoke them regardless of authentication state.

Attack Vector

The attack vector is network-based (AV:N) with low attack complexity and no privileges or user interaction required. An attacker crafts an HTTP POST or GET request to the vulnerable plugin endpoint on a targeted WordPress site. The server processes the request as if it were authorized and executes the plugin logic, altering settings or checkout-related state.

The vulnerability mechanism is described in the Patchstack advisory. No public exploit code or proof-of-concept has been published at time of writing.

Detection Methods for CVE-2025-29006

Indicators of Compromise

Unauthenticated HTTP requests to admin-ajax.php or plugin REST routes referencing woo-direct-checkout-lite action names.
Unexpected modifications to WooCommerce or plugin settings in the wp_options table without corresponding admin login sessions.
Access log entries showing repeated POST requests from a single source IP to plugin-controlled endpoints.

Detection Strategies

Review WordPress access logs for requests to plugin endpoints that lack an authenticated session cookie or valid nonce parameter.
Deploy a web application firewall (WAF) rule that flags requests to woo-direct-checkout-lite action handlers originating from unauthenticated sessions.
Enable WordPress audit logging to record changes to plugin settings and correlate those events with authenticated user activity.

Monitoring Recommendations

Monitor for anomalous configuration changes in WooCommerce checkout options and plugin settings.
Alert on spikes in traffic to /wp-admin/admin-ajax.php with plugin-specific action parameters from non-logged-in users.
Track outbound behavior from the WordPress host for signs of secondary compromise following unauthorized configuration changes.

How to Mitigate CVE-2025-29006

Immediate Actions Required

Identify all WordPress installations running woo-direct-checkout-lite version 1.0.3 or earlier.
Deactivate the plugin until a patched release is confirmed available from the vendor.
Apply virtual patching through a WAF to block unauthenticated access to the affected plugin endpoints.

Patch Information

No fixed version is listed in the current advisory. Consult the Patchstack vulnerability database entry and the plugin's official WordPress.org page for the latest release information before re-enabling the plugin.

Workarounds

Restrict access to /wp-admin/ and admin-ajax.php at the network edge to trusted IP ranges where feasible.
Use a security plugin or WAF rule set that enforces capability and nonce checks on plugin actions.
Replace woo-direct-checkout-lite with an alternative direct checkout plugin from a maintained vendor if a patch is not released in a reasonable timeframe.

bash

# Nginx example: block unauthenticated requests to the affected plugin action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "woo_direct_checkout_lite") {
        set $block_unauth 1;
    }
    if ($http_cookie !~* "wordpress_logged_in") {
        set $block_unauth "${block_unauth}1";
    }
    if ($block_unauth = "11") {
        return 403;
    }
}