CVE-2025-49287 Overview
CVE-2025-49287 is a missing authorization vulnerability in the WebToffee Product Feed for WooCommerce WordPress plugin. The flaw affects all versions up through 2.2.8 and stems from incorrectly configured access control on plugin functionality. Authenticated users with low privilege levels can invoke actions that should require higher authorization. The issue is tracked under CWE-862: Missing Authorization and is documented in the Patchstack Vulnerability Report.
Critical Impact
Low-privileged authenticated users can perform actions restricted to higher-privileged roles, leading to limited integrity impact on WooCommerce product feed data.
Affected Products
- WebToffee Product Feed for WooCommerce (webtoffee-product-feed)
- All versions from n/a through <= 2.2.8
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-06-06 - CVE-2025-49287 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49287
Vulnerability Analysis
The vulnerability originates from broken access control in the WebToffee Product Feed for WooCommerce plugin. Specific plugin endpoints or AJAX handlers fail to verify whether the requesting user holds the required WordPress capability before executing sensitive actions. This class of flaw, categorized as CWE-862, allows any authenticated user to invoke functionality intended for administrators or shop managers.
The attack requires network access to the WordPress site and valid authenticated credentials, but no user interaction. Impact is limited to integrity of the product feed data. Confidentiality and availability of the broader system are not directly affected. The Patchstack advisory classifies this as a broken access control issue in the plugin.
Root Cause
The plugin registers handler functions that omit current_user_can() capability checks or rely on is_user_logged_in() alone. Without an explicit capability gate, WordPress passes any authenticated request to the handler. Missing nonce validation compounds the exposure by permitting request forgery vectors.
Attack Vector
An attacker with a low-privilege WordPress account, such as a subscriber or customer, sends crafted requests to unprotected plugin endpoints. The endpoint executes the requested action because it does not enforce role or capability restrictions. This can result in unauthorized modification of product feed configuration or generated feed content. Refer to the Patchstack Vulnerability Report for the technical breakdown.
Detection Methods for CVE-2025-49287
Indicators of Compromise
- Unexpected modifications to product feed settings or generated feed files owned by the webtoffee-product-feed plugin.
- HTTP POST requests to plugin AJAX endpoints originating from low-privilege user sessions.
- New or altered feed configurations that were not initiated by administrator accounts.
Detection Strategies
- Audit WordPress access logs for requests to wp-admin/admin-ajax.php referencing plugin actions from non-admin session cookies.
- Compare current plugin settings against a known-good baseline to identify unauthorized changes.
- Review WooCommerce user activity for subscriber or customer accounts triggering plugin-scoped actions.
Monitoring Recommendations
- Enable WordPress audit logging with a plugin such as WP Activity Log to capture capability-check failures and admin actions.
- Alert on HTTP 200 responses to plugin endpoints from users whose role is below shop manager.
- Monitor filesystem changes under wp-content/uploads/ directories used by the plugin for feed generation.
How to Mitigate CVE-2025-49287
Immediate Actions Required
- Update the WebToffee Product Feed for WooCommerce plugin to a version later than 2.2.8 as soon as the vendor publishes a fixed release.
- Restrict WordPress user registration to trusted parties and audit existing low-privilege accounts.
- Review recent changes to product feed configuration and revert any unauthorized modifications.
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 2.2.8. Monitor the Patchstack advisory and the WebToffee plugin repository for the fixed release. Apply the update through the WordPress admin dashboard or via WP-CLI once available.
Workarounds
- Deactivate the WebToffee Product Feed for WooCommerce plugin until a patched version is released if product feeds are not business critical.
- Deploy a Web Application Firewall (WAF) rule to block requests to plugin AJAX actions from non-administrator sessions.
- Enforce least privilege on WordPress accounts and disable open registration where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
