CVE-2025-47461: WooCommerce Subaccounts Auth Bypass Flaw

CVE-2025-47461 Overview

CVE-2025-47461 is an authentication bypass vulnerability in the mediaticus Subaccounts for WooCommerce plugin for WordPress. The flaw affects all versions of subaccounts-for-woocommerce up to and including 1.6.6. An attacker with low-privilege authenticated access can abuse an alternate path or channel to take over other accounts on the affected WooCommerce store. The weakness maps to [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Authenticated attackers can bypass authentication checks and take over arbitrary subaccounts, gaining full read, write, and administrative control over targeted user accounts in WooCommerce stores running the vulnerable plugin.

Affected Products

mediaticus Subaccounts for WooCommerce plugin (subaccounts-for-woocommerce)
All versions from initial release through 1.6.6
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-05-23 - CVE-2025-47461 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47461

Vulnerability Analysis

The Subaccounts for WooCommerce plugin allows store owners to create subaccounts linked to a parent customer account. The plugin contains an authentication bypass flaw that lets a low-privileged authenticated user reach functionality reserved for other accounts through an alternate code path. The result is full account takeover, including confidentiality, integrity, and availability impact on the victim account.

The issue is tracked as [CWE-288]. CWE-288 vulnerabilities occur when an application enforces authentication on a primary entry point but exposes secondary handlers, endpoints, or AJAX actions that perform the same privileged operations without re-checking the caller's identity or ownership of the target object.

The EPSS score is 0.449% (percentile 35.676), indicating limited observed exploitation activity at this time.

Root Cause

The root cause is missing or insufficient authorization validation on a secondary code path inside the plugin. The primary login and account-switching flows likely validate session ownership, but at least one supporting endpoint accepts user-controlled identifiers and acts on the referenced account without confirming the caller owns or has been delegated rights to that account.

Because the bypass requires authentication, exploitation is gated to users who can register or already hold a customer-level account on the store. WooCommerce stores typically allow open customer registration, which makes the precondition trivial to satisfy.

Attack Vector

The attacker first authenticates as any low-privileged user on the target WooCommerce site. The attacker then sends a crafted request to the vulnerable plugin endpoint, supplying the identifier of the target subaccount or parent account. The plugin honors the request and either authenticates the attacker as the target user or performs privileged actions on the target account.

Full technical reproduction details are documented in the Patchstack Vulnerability Report.

No public proof-of-concept code is referenced in the available CVE data, so a sanitized exploitation snippet is omitted here.

Detection Methods for CVE-2025-47461

Indicators of Compromise

Unexpected successful authentications or session changes for customer accounts that did not perform a normal login.
WooCommerce order, address, or password changes initiated from IP addresses that differ from the account's historical pattern.
HTTP requests to subaccounts-for-woocommerce plugin endpoints carrying user or account identifiers belonging to other customers.
New administrative or subaccount link relationships created without a corresponding store-owner action in the audit log.

Detection Strategies

Inspect web server and WordPress access logs for repeated requests to plugin paths under /wp-content/plugins/subaccounts-for-woocommerce/ or related AJAX actions with varying numeric identifiers.
Correlate WordPress wp_users and wp_usermeta changes with authenticated session IDs to identify cross-account modifications.
Alert on customer accounts performing actions immediately after authenticating as a different account in the same session.

Monitoring Recommendations

Enable verbose logging for WooCommerce authentication and account-management events.
Forward WordPress and reverse-proxy logs to a centralized analytics platform and retain them for at least 90 days.
Track the installed version of subaccounts-for-woocommerce across all managed WordPress sites and flag any instance at or below 1.6.6.

How to Mitigate CVE-2025-47461

Immediate Actions Required

Update the Subaccounts for WooCommerce plugin to a version released after 1.6.6 that addresses CVE-2025-47461.
If no fixed version is available, deactivate and remove the plugin until a patched release is published.
Force a password reset and session invalidation for all customer and subaccount users on affected stores.
Review recent orders, address changes, and account modifications for signs of unauthorized activity.

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed-version guidance from the plugin maintainer. The CVE record lists all versions through 1.6.6 as affected.

Workarounds

Disable the subaccounts-for-woocommerce plugin on production sites until a fix is verified.
Restrict customer self-registration on the WooCommerce store to reduce the pool of accounts capable of triggering the bypass.
Use a Web Application Firewall (WAF) rule to block requests to plugin endpoints that reference account identifiers not matching the authenticated session's user ID.
Apply least-privilege review on existing subaccount relationships and remove any that are no longer required.

bash

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate subaccounts-for-woocommerce
wp plugin status subaccounts-for-woocommerce