CVE-2025-58835: Bonus for Woo Auth Bypass Vulnerability

CVE-2025-58835 Overview

CVE-2025-58835 is a broken access control vulnerability in the Bonus for Woo WordPress plugin developed by calliko. The flaw stems from improper validation of specified input quantity, allowing unauthenticated attackers to access functionality that is not properly constrained by access control lists (ACLs). The issue affects all plugin versions up to and including 7.6.6. The vulnerability is categorized under CWE-1284 — Improper Validation of Specified Quantity in Input. Exploitation requires no authentication and no user interaction, but the integrity impact is limited in scope.

Critical Impact
Unauthenticated remote attackers can invoke plugin functionality without proper access control checks, resulting in limited integrity impact on WooCommerce stores using the Bonus for Woo plugin.

Affected Products

calliko Bonus for Woo WordPress plugin (bonus-for-woo)
All versions from initial release through 7.6.6
WooCommerce stores using the vulnerable plugin

Discovery Timeline

2025-09-05 - CVE-2025-58835 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58835

Vulnerability Analysis

The vulnerability resides in the Bonus for Woo plugin, an extension for WooCommerce that manages bonus and reward functionality. The plugin exposes functionality that is reachable over the network without enforcing proper authorization checks. An attacker can send crafted requests to plugin endpoints and trigger actions that should be restricted to authorized users. The root cause is classified as [CWE-1284], where the plugin fails to properly validate quantity-related input against expected constraints. The Patchstack advisory categorizes this as an "other" vulnerability type affecting Bonus for Woo versions up to 7.4.1 and later confirmed through 7.6.6. See the Patchstack WordPress Vulnerability advisory for additional context.

Root Cause

The plugin exposes callable functions or REST endpoints without adequately verifying the caller's capabilities or validating input quantities. Missing capability checks (current_user_can()) or nonce verification in AJAX handlers allow unauthenticated requests to invoke privileged plugin logic. Improper input quantity validation compounds the issue by permitting values outside expected bounds.

Attack Vector

An attacker sends HTTP requests directly to the vulnerable plugin endpoint over the network. No credentials or user interaction are required. The attacker manipulates request parameters to invoke plugin functionality that should be gated by ACLs, resulting in limited integrity impact. Confidentiality and availability are not affected according to the CVSS vector. No public proof-of-concept exploit is currently available.

No verified exploit code is available for this CVE.
Refer to the Patchstack advisory for technical details on the affected endpoints.

Detection Methods for CVE-2025-58835

Indicators of Compromise

Unexpected HTTP POST requests to /wp-admin/admin-ajax.php referencing Bonus for Woo actions from unauthenticated sessions
Anomalous modifications to WooCommerce bonus configurations, coupons, or reward point balances without corresponding administrator activity
Access log entries showing requests to plugin-specific endpoints under /wp-content/plugins/bonus-for-woo/ from external IP addresses

Detection Strategies

Review WordPress access logs for requests to Bonus for Woo AJAX or REST endpoints originating from unauthenticated sessions
Audit WooCommerce activity for unauthorized bonus, reward, or coupon changes correlated with the timestamp of suspicious requests
Deploy Web Application Firewall (WAF) rules that inspect requests targeting bonus-for-woo action parameters

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for correlation
Monitor for spikes in AJAX traffic to plugin endpoints and alert on requests missing valid nonces
Track changes to WooCommerce database tables associated with the plugin's bonus records for unauthorized writes

How to Mitigate CVE-2025-58835

Immediate Actions Required

Identify all WordPress instances running the Bonus for Woo plugin at version 7.6.6 or earlier
Update the plugin to a fixed version once released by the vendor, or deactivate and remove the plugin if no patched release is available
Restrict access to /wp-admin/admin-ajax.php and plugin endpoints using WAF rules or IP allowlisting where feasible

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack covers Bonus for Woo versions through 7.6.6. Administrators should consult the plugin's official changelog on the WordPress plugin repository for a patched release and apply updates promptly.

Workarounds

Deactivate the Bonus for Woo plugin until a patched version is available
Deploy a virtual patching rule via a WAF such as Patchstack, Wordfence, or Sucuri to block exploit attempts
Restrict administrative endpoints using server-level authentication or IP-based access controls

bash

# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate bonus-for-woo

# Remove the plugin entirely if not required
wp plugin uninstall bonus-for-woo