CVE-2025-47473: PW WooCommerce Bulk Edit CSRF Vulnerability

CVE-2025-47473 Overview

CVE-2025-47473 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the PW WooCommerce Bulk Edit WordPress plugin developed by pimwick. The flaw exists in all plugin versions up to and including 2.134. An attacker can craft a malicious web page that, when visited by an authenticated WordPress administrator, submits forged requests to the vulnerable plugin endpoints. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Successful exploitation can result in unauthorized modification of WooCommerce product data through bulk-edit operations. The issue requires user interaction, which limits automated mass exploitation.

Critical Impact
An authenticated administrator visiting an attacker-controlled page can trigger unauthorized bulk edits to WooCommerce products, resulting in integrity and availability impact on store data.

Affected Products

pimwick PW WooCommerce Bulk Edit plugin for WordPress
All versions from initial release through 2.134
WooCommerce stores running the vulnerable plugin

Discovery Timeline

2025-05-07 - CVE-2025-47473 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47473

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protection on state-changing endpoints in the pw-bulk-edit plugin. WordPress provides nonce tokens through functions such as wp_nonce_field() and check_admin_referer() to bind requests to authenticated sessions. When these controls are absent or improperly validated, the browser of an authenticated administrator will attach session cookies to any request initiated from a third-party site. The plugin then processes those requests as legitimate administrative actions. The vulnerability is exposed over the network and requires user interaction, meaning an administrator must be tricked into visiting an attacker-controlled page while logged into WordPress. The EPSS score is 0.136%, indicating low current exploitation probability.

Root Cause

The root cause is the absence of proper anti-CSRF token validation on bulk-edit request handlers within the plugin. Administrative endpoints that modify WooCommerce product attributes accept requests without verifying a per-session nonce. This allows cross-origin form submissions or automatic image/link requests to reach the plugin as authenticated actions.

Attack Vector

An attacker hosts a page containing a hidden form or JavaScript that submits a POST request to the target WordPress site's bulk-edit endpoint. When an authenticated administrator visits the page, the browser attaches the WordPress session cookie and executes the request. The plugin processes the forged submission as an authorized bulk edit. No credentials are needed by the attacker because the victim's browser supplies them automatically.

For technical specifics, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-47473

Indicators of Compromise

Unexpected bulk modifications to WooCommerce product fields such as prices, stock, or SKUs without corresponding admin activity in audit logs
WordPress access logs showing POST requests to pw-bulk-edit endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions that generated bulk-edit requests immediately after visiting unfamiliar third-party sites

Detection Strategies

Review WordPress audit logs for bulk product edits and correlate against expected administrator workflows
Inspect web server access logs for requests to plugin endpoints containing an external Referer or missing WordPress-origin Origin headers
Deploy Web Application Firewall (WAF) rules that flag state-changing requests to /wp-admin/ paths lacking valid WordPress nonces

Monitoring Recommendations

Enable a WordPress activity log plugin that records product modifications, actor identity, and source IP
Monitor for spikes in bulk product changes and alert administrators on out-of-hours edits
Correlate administrator browser telemetry with WordPress admin activity to identify cross-origin submission patterns

How to Mitigate CVE-2025-47473

Immediate Actions Required

Identify all WordPress installations running PW WooCommerce Bulk Edit version 2.134 or earlier and prioritize remediation
Restrict administrator accounts to dedicated browsers or sessions that are not used for general browsing
Require administrators to log out of WordPress when the session is not actively in use

Patch Information

At the time of publication, review the Patchstack advisory for the latest patched version from pimwick. Update the plugin to the fixed release as soon as it becomes available through the WordPress plugin repository.

Workarounds

Disable the PW WooCommerce Bulk Edit plugin until a patched version is installed
Deploy a WAF rule that blocks requests to plugin endpoints when the Referer or Origin header does not match the WordPress site domain
Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-origin cookie attachment

bash

# Configuration example: enforce SameSite on WordPress auth cookies via wp-config.php
define('COOKIE_DOMAIN', 'example.com');
# In a custom mu-plugin, harden cookie flags:
# add_filter('secure_auth_cookie', '__return_true');
# ini_set('session.cookie_samesite', 'Strict');