CVE-2025-57957: WooMS Auth Bypass Vulnerability

CVE-2025-57957 Overview

CVE-2025-57957 is a missing authorization vulnerability affecting the wpcraft WooMS plugin for WordPress. The flaw exists in versions up to and including 9.12 and results from incorrectly configured access control on plugin functionality. Remote attackers can reach protected actions without proper authorization checks, leading to limited integrity impact on affected WordPress sites. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated network-based access to plugin functionality that should require authorization, enabling attackers to modify data exposed by the WooMS integration.

Affected Products

wpcraft WooMS plugin for WordPress
WooMS versions from n/a through <= 9.12
WordPress installations running the WooMS integration for WooCommerce and MoySklad synchronization

Discovery Timeline

2025-09-22 - CVE-2025-57957 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57957

Vulnerability Analysis

The WooMS plugin exposes functionality that lacks proper authorization enforcement. An attacker sending crafted HTTP requests to the plugin's endpoints can invoke actions without holding the required capability or role. The vendor advisory from Patchstack classifies this as a broken access control issue affecting plugin functionality intended for privileged administrators.

Because the attack vector is network-based and requires no authentication or user interaction, exploitation only requires reaching a vulnerable WordPress site with the WooMS plugin installed. The impact is scoped to integrity, meaning attackers can alter certain data managed by the plugin but cannot directly extract confidential information or disrupt availability through this flaw alone.

The EPSS probability sits at roughly 0.35%, indicating limited observed exploitation interest as of the scoring date. However, WordPress plugin flaws in this class historically attract automated scanning once proof-of-concept details become public.

Root Cause

The root cause is missing capability or nonce validation on one or more plugin request handlers. WordPress plugins must call current_user_can() and verify nonces on privileged actions. When these checks are omitted or misconfigured, requests from unauthenticated visitors reach code paths intended only for administrators.

Attack Vector

An attacker sends HTTP requests directly to the vulnerable WooMS endpoints over the network. No credentials, session tokens, or user interaction are required. Refer to the Patchstack WordPress Vulnerability Report for endpoint-level technical details.

No verified public exploit code is available at this time. The vulnerability mechanism is documented in the vendor advisory linked above.

Detection Methods for CVE-2025-57957

Indicators of Compromise

Unauthenticated HTTP requests to WooMS plugin AJAX endpoints or REST routes under /wp-admin/admin-ajax.php or /wp-json/ referencing wooms actions
Unexpected changes to WooCommerce product data, stock levels, or synchronization state managed by WooMS
Access log entries showing repeated POST requests to plugin handlers from single external IP addresses without prior authenticated session cookies

Detection Strategies

Review WordPress access logs for requests targeting WooMS action parameters originating from unauthenticated sessions
Correlate plugin activity logs with WordPress user session data to identify actions performed without a valid logged-in administrator
Monitor WooCommerce audit trails for product or inventory modifications that do not map to a legitimate administrative user

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture actions performed by anonymous requests
Forward web server access logs to a centralized log platform and alert on high-volume requests to admin-ajax.php with action=wooms_* parameters
Track plugin version inventory across managed WordPress sites and flag installations still running WooMS <= 9.12

How to Mitigate CVE-2025-57957

Immediate Actions Required

Update the wpcraft WooMS plugin to a version later than 9.12 as soon as the vendor releases a fixed release
Audit WordPress sites for the presence of the WooMS plugin and confirm the installed version
Restrict administrative endpoints at the web server or WAF layer to trusted IP ranges where feasible

Patch Information

Consult the Patchstack advisory for the current patched version and vendor guidance. The advisory tracks the fixed release for the WooMS plugin.

Workarounds

Deactivate and remove the WooMS plugin until a patched version is installed if MoySklad synchronization is not business-critical
Deploy a Web Application Firewall rule blocking unauthenticated requests to admin-ajax.php with action parameters matching WooMS handlers
Enforce authentication on /wp-admin/ via HTTP basic auth or IP allowlisting at the reverse proxy layer

bash

# Example WAF rule (ModSecurity syntax) blocking unauthenticated WooMS AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1057957,phase:2,deny,status:403,msg:'Block unauthenticated WooMS action'"
SecRule ARGS:action "@rx ^wooms_" "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"