CVE-2025-57894 Overview
CVE-2025-57894 is a missing authorization vulnerability in the ollybach WPPizza plugin for WordPress. The flaw affects WPPizza versions from an unspecified initial release through 3.19.8. The vulnerability stems from incorrectly configured access control security levels, categorized under [CWE-862] Missing Authorization. An authenticated attacker with low privileges can exploit the flaw over the network to perform actions that should require elevated authorization. The issue carries a CVSS 3.1 base score of 4.3 and is tracked in the Patchstack vulnerability database.
Critical Impact
Authenticated low-privilege users can bypass access control checks in WPPizza to perform actions that affect data integrity on WordPress sites running vulnerable versions of the plugin.
Affected Products
- ollybach WPPizza plugin for WordPress
- WPPizza versions through 3.19.8
- WordPress sites with WPPizza installed and activated
Discovery Timeline
- 2025-08-22 - CVE-2025-57894 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57894
Vulnerability Analysis
The WPPizza plugin exposes functionality that fails to properly verify user authorization before executing privileged actions. WPPizza is a WordPress plugin that adds pizza ordering and restaurant menu capabilities to WordPress sites. The plugin registers endpoints and handlers that check whether a request is authenticated but do not enforce role-based or capability-based authorization checks.
An attacker holding any authenticated WordPress account, including a subscriber-level user, can issue requests to the affected plugin handlers. Because WordPress sites commonly permit open user registration, this access barrier is low in many deployments. The resulting unauthorized action impacts integrity, though confidentiality and availability remain unaffected based on the CVSS vector.
Root Cause
The root cause is a missing capability check [CWE-862] in one or more plugin handlers. WordPress plugins must call current_user_can() or verify nonces tied to privileged roles before executing administrative actions. WPPizza through 3.19.8 omits these checks on specific action handlers, treating authentication alone as sufficient authorization.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid authenticated session with low privileges. The attacker sends a crafted HTTP request to the vulnerable WPPizza endpoint, invoking functionality that should be restricted to administrators or shop managers. No user interaction is required beyond the attacker's own request. The Patchstack advisory documents the affected request paths and parameters. See the Patchstack WP Pizza Plugin Vulnerability advisory for the technical details of the affected handlers.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-57894
Indicators of Compromise
- Unexpected modifications to WPPizza menu items, orders, or plugin configuration entries in the WordPress database
- HTTP POST requests to WPPizza admin-ajax.php actions originating from low-privileged user sessions
- WordPress audit log entries showing privileged WPPizza actions performed by subscriber or customer accounts
Detection Strategies
- Inventory WordPress installations and identify sites running WPPizza at version 3.19.8 or earlier
- Review web server access logs for admin-ajax.php requests referencing WPPizza actions from non-administrative user accounts
- Correlate authenticated session identifiers with the WordPress user roles associated with each request to spot privilege mismatches
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record plugin configuration changes and user role actions
- Forward WordPress and web server logs to a centralized SIEM for correlation and retention
- Alert on new user registrations followed by immediate requests to plugin administrative endpoints
How to Mitigate CVE-2025-57894
Immediate Actions Required
- Update the WPPizza plugin to a version later than 3.19.8 once a patched release is published by the vendor
- Disable the WPPizza plugin on sites where an update is not yet available and the functionality is non-essential
- Audit WordPress user accounts and remove unused low-privilege accounts that could be leveraged by attackers
Patch Information
Refer to the Patchstack WP Pizza Plugin Vulnerability advisory for the latest patch status. At the time of CVE publication, the issue affects WPPizza through 3.19.8. Site operators should monitor the WordPress plugin repository for a fixed release and apply updates promptly.
Workarounds
- Restrict WordPress user registration to trusted email domains or disable open registration entirely
- Place the WordPress admin area and admin-ajax.php behind a web application firewall rule that blocks WPPizza action parameters from non-administrative sessions
- Enforce multi-factor authentication for all WordPress accounts to raise the cost of acquiring a usable low-privilege session
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
