CVE-2025-47634 Overview
CVE-2025-47634 is a Missing Authorization vulnerability [CWE-862] affecting the Keylor Mendoza WC Pickup Store plugin for WordPress. The flaw affects all versions of wc-pickup-store from n/a through 1.8.9. Attackers can exploit incorrectly configured access control security levels to modify plugin settings without proper authorization checks. The vulnerability is remotely exploitable over the network without authentication or user interaction. It carries an EPSS score of 0.29% (20.9th percentile), indicating relatively low current exploitation likelihood.
Critical Impact
Unauthenticated attackers can change WC Pickup Store plugin settings on affected WordPress sites, altering pickup store configurations and business logic.
Affected Products
- Keylor Mendoza WC Pickup Store plugin for WordPress
- All versions from n/a through 1.8.9
- WordPress sites running the wc-pickup-store plugin with WooCommerce
Discovery Timeline
- 2025-07-04 - CVE-2025-47634 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47634
Vulnerability Analysis
The WC Pickup Store plugin exposes one or more settings-modification actions without enforcing capability checks on the requesting user. WordPress plugins typically protect administrative endpoints using current_user_can() capability verification and nonce validation. In the affected versions of wc-pickup-store, these checks are missing or improperly configured on settings handlers.
An unauthenticated remote attacker can send crafted HTTP requests to the vulnerable endpoints and change plugin configuration values. The vulnerability aligns with [CWE-862: Missing Authorization], where the application does not perform an authorization check when a user attempts to access a resource or perform an action.
The impact is limited to integrity and availability of the plugin's stored configuration. Confidentiality is not directly affected, but altered settings can disrupt pickup store operations, redirect business logic, or produce downstream effects on WooCommerce order handling.
Root Cause
The root cause is the absence of proper capability and nonce validation on administrative AJAX or REST endpoints exposed by the plugin. Handler functions execute privileged settings changes without verifying that the caller holds an administrative role such as manage_options or manage_woocommerce.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker locates a WordPress site running WC Pickup Store version 1.8.9 or earlier and sends HTTP requests to the vulnerable settings endpoint. The plugin processes the request and persists attacker-controlled values in the WordPress options table.
Refer to the Patchstack WordPress Vulnerability Advisory for advisory-level details on the affected handler.
Detection Methods for CVE-2025-47634
Indicators of Compromise
- Unexpected changes to WC Pickup Store plugin settings in the WordPress admin panel or wp_options table entries prefixed with wc_pickup_store or similar.
- HTTP POST or AJAX requests to admin-ajax.php or plugin REST routes containing wc-pickup-store action names from unauthenticated sources.
- WooCommerce pickup store configurations reverting or reflecting values not entered by legitimate administrators.
Detection Strategies
- Review web server access logs for anonymous requests targeting wp-admin/admin-ajax.php with action= parameters referencing the plugin.
- Audit the wp_options table for recent modifications to plugin-managed keys using the option_name and update timestamps.
- Deploy a Web Application Firewall (WAF) rule to flag unauthenticated requests hitting the plugin's settings action names.
Monitoring Recommendations
- Enable WordPress audit logging to capture settings changes with user attribution and source IP.
- Alert on modifications to plugin option keys performed by users lacking the manage_options capability.
- Monitor for spikes in admin-ajax.php traffic from single IP addresses without valid authentication cookies.
How to Mitigate CVE-2025-47634
Immediate Actions Required
- Update the WC Pickup Store plugin to a version later than 1.8.9 once the vendor publishes a fix, per the Patchstack advisory.
- Restrict access to wp-admin/admin-ajax.php and plugin endpoints at the WAF or reverse proxy layer for unauthenticated sources where feasible.
- Audit current plugin settings against a known-good baseline and revert any unauthorized changes.
Patch Information
At the time of the referenced advisory, WC Pickup Store versions through 1.8.9 are affected. Site administrators should consult the Patchstack advisory and the plugin's WordPress.org listing for the current patched release and upgrade immediately when available.
Workarounds
- Deactivate and remove the WC Pickup Store plugin until a patched version is installed if the plugin is not essential.
- Deploy virtual patching via a WAF rule that blocks unauthenticated requests to the plugin's AJAX or REST endpoints.
- Restrict administrative WordPress paths to trusted IP ranges using web server access controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
