CVE-2025-30959: WooCommerce XML Feed Auth Bypass Flaw

CVE-2025-30959 Overview

CVE-2025-30959 is a Missing Authorization vulnerability [CWE-862] affecting the WPFactory Product XML Feed Manager for WooCommerce plugin (product-xml-feeds-for-woocommerce). The flaw exists in versions up to and including 2.9.2 and stems from incorrectly configured access control on plugin functionality. Unauthenticated attackers can reach protected actions over the network without user interaction. Successful exploitation can modify plugin state and disrupt feed availability on affected WooCommerce stores.

Critical Impact
Unauthenticated network-based access to restricted plugin functionality that can alter WooCommerce product feed data and availability on any site running vulnerable versions.

Affected Products

WPFactory Product XML Feed Manager for WooCommerce plugin (product-xml-feeds-for-woocommerce)
All versions from initial release through 2.9.2
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-07-16 - CVE-2025-30959 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30959

Vulnerability Analysis

The plugin exposes functionality without enforcing proper authorization checks on requests. Attackers can invoke restricted actions by sending crafted HTTP requests directly to the plugin's endpoints. The vulnerability affects the integrity and availability of feed data managed by the plugin. Because no authentication or user interaction is required, exploitation can be automated at scale against WordPress sites using vulnerable versions.

Root Cause

The root cause is a missing authorization check [CWE-862] on plugin actions. Code paths that should be restricted to administrators or specific privileged roles do not validate the requester's capability or nonce before executing. This class of flaw typically arises when developers rely on UI-level restrictions rather than server-side capability checks such as current_user_can() in WordPress.

Attack Vector

An attacker sends an HTTP request to the vulnerable plugin endpoint on a target WordPress site. The request targets AJAX handlers, admin-post actions, or REST routes registered by the plugin that lack capability enforcement. No credentials, prior access, or social engineering are needed. The attacker can trigger the exposed operation and affect feed configuration or content.

No public proof-of-concept exploit is currently listed for CVE-2025-30959, and it is not present in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.308%. Technical details are documented in the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2025-30959

Indicators of Compromise

Unexpected modifications to XML feed configurations or generated feed files produced by the plugin
HTTP requests to plugin-specific endpoints under /wp-admin/admin-ajax.php or /wp-admin/admin-post.php originating from unauthenticated sessions
Anomalous access patterns to plugin routes from single IPs targeting many WordPress hosts

Detection Strategies

Review WordPress access logs for requests referencing product-xml-feeds-for-woocommerce action parameters without an authenticated session cookie
Compare plugin configuration and generated feed content against known-good baselines on a scheduled basis
Alert on repeated POST requests to plugin admin endpoints returning 200 status codes without prior authentication

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes and administrative actions
Monitor outbound feed URLs consumed by third parties for unexpected content changes
Track plugin version inventory across all WordPress installations to identify systems still on 2.9.2 or earlier

How to Mitigate CVE-2025-30959

Immediate Actions Required

Update the Product XML Feed Manager for WooCommerce plugin to a version later than 2.9.2 as soon as a patched release is available
Audit WordPress sites for the presence of product-xml-feeds-for-woocommerce and record installed versions
Restrict access to /wp-admin/ paths at the web server or WAF layer to trusted IP ranges where feasible
Review recent changes to plugin settings and generated XML feeds for signs of tampering

Patch Information

Refer to the Patchstack Vulnerability Advisory for the current fix status. Administrators should apply the vendor-supplied update once released and confirm the installed version exceeds 2.9.2.

Workarounds

Deactivate and remove the plugin until a fixed version is installed if feed functionality is not business-critical
Deploy WAF rules to block unauthenticated requests to plugin AJAX and admin-post actions
Enforce two-factor authentication on administrator accounts to reduce lateral impact if plugin state is manipulated

bash

# Identify installed plugin version on a WordPress host
wp plugin get product-xml-feeds-for-woocommerce --field=version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate product-xml-feeds-for-woocommerce