CVE-2025-39602: WooCommerce Product Table Auth Bypass Flaw

CVE-2025-39602 is a missing authorization vulnerability in WooCommerce Product Table Lite plugin affecting versions up to 3.9.5. Attackers can exploit misconfigured access controls to bypass security. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2025-39602 Overview

CVE-2025-39602 is a missing authorization vulnerability in the WooCommerce Product Table Lite plugin (wc-product-table-lite) for WordPress. The flaw stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to invoke plugin functionality they should not access. The issue affects all versions of WooCommerce Product Table Lite from initial release through 3.9.5. The vulnerability is categorized under [CWE-862] Missing Authorization and requires network access with low-level authentication to exploit.

Critical Impact
Authenticated attackers with minimal WordPress privileges can bypass access control checks in the plugin, resulting in unauthorized modification of plugin data or configuration on affected WooCommerce sites.

Affected Products

WooCommerce Product Table Lite plugin (wc-product-table-lite)
All versions from initial release through 3.9.5
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-04-16 - CVE-2025-39602 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39602

Vulnerability Analysis

The WooCommerce Product Table Lite plugin exposes functionality through WordPress endpoints without enforcing sufficient capability checks. An authenticated user with low privileges, such as a subscriber or customer role, can send crafted requests to plugin actions that should be restricted to administrators or shop managers. The absence of proper authorization validation permits actions outside the requester's intended role scope.

The integrity impact is limited to plugin-scoped data rather than the underlying WordPress core, but this still creates a foothold for content tampering or configuration abuse on production WooCommerce stores. Neither confidentiality nor availability are directly affected by this specific weakness.

Root Cause

The root cause is a missing current_user_can() capability check or equivalent authorization gate on one or more plugin handlers. WordPress plugin developers must validate both nonce tokens and user capabilities on every state-changing endpoint. When authorization checks are omitted, any authenticated session can trigger privileged actions regardless of role.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid low-privilege account. Attackers authenticate using any registered account, then send HTTP requests to the vulnerable plugin endpoint. Because WooCommerce sites frequently allow customer registration, obtaining low-privilege access is trivial on most storefronts. Refer to the Patchstack Vulnerability Report for endpoint-level technical detail.

// No verified proof-of-concept code available.
// See the Patchstack advisory for endpoint-specific details.

Detection Methods for CVE-2025-39602

Indicators of Compromise

Unexpected changes to WooCommerce product table configurations or shortcode settings originating from non-administrator accounts.
WordPress access logs showing POST or AJAX requests to wc-product-table-lite endpoints from users with subscriber or customer roles.
Newly created or modified plugin option entries in the wp_options table that correlate with low-privilege user sessions.

Detection Strategies

Audit WordPress activity logs for requests to admin-ajax.php referencing plugin actions tied to wc-product-table-lite.
Correlate authenticated session identifiers against user roles to identify low-privilege accounts invoking administrator-scoped operations.
Deploy web application firewall rules that inspect request parameters against user capability context.

Monitoring Recommendations

Enable verbose logging on WordPress and WooCommerce plugin actions using an audit logging plugin.
Alert on any modifications to plugin settings performed outside of administrator sessions.
Track the plugin version across all WordPress installations to identify hosts still running 3.9.5 or earlier.

How to Mitigate CVE-2025-39602

Immediate Actions Required

Upgrade WooCommerce Product Table Lite to a version later than 3.9.5 as soon as the vendor releases a patched build.
Review WordPress user accounts and remove or suspend unnecessary low-privilege accounts that could be leveraged for exploitation.
Inspect plugin configuration and product table settings for unauthorized modifications made prior to patching.

Patch Information

Monitor the Patchstack Vulnerability Report for the fixed release. Apply the patched version through the WordPress admin plugin updater or via WP-CLI. Verify the installed version after upgrade to confirm remediation.

Workarounds

Temporarily deactivate the WooCommerce Product Table Lite plugin until a patched version is installed.
Restrict registration on the WooCommerce site to limit the pool of authenticated accounts able to reach the vulnerable endpoint.
Deploy a web application firewall rule to block requests targeting the vulnerable plugin actions from non-administrator sessions.

bash

# Update the plugin using WP-CLI after a patched version is released
wp plugin update wc-product-table-lite
wp plugin get wc-product-table-lite --field=version