CVE-2025-64285 Overview
CVE-2025-64285 is a missing authorization vulnerability in the Premmerce Wholesale Pricing for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.10. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to exploit incorrectly configured access control security levels. The issue is tracked under CWE-862: Missing Authorization and was published to the National Vulnerability Database on October 29, 2025.
Critical Impact
Authenticated attackers with low privileges can access or modify plugin functionality that should be restricted, affecting integrity and availability of WooCommerce wholesale pricing configurations.
Affected Products
- Premmerce Wholesale Pricing for WooCommerce plugin (premmerce-woocommerce-wholesale-pricing)
- All versions from initial release through 1.1.10
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-10-29 - CVE-2025-64285 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64285
Vulnerability Analysis
The vulnerability originates from missing authorization checks in one or more plugin endpoints. WordPress plugins must validate both authentication and capability before executing privileged actions. The Premmerce Wholesale Pricing plugin verifies that a user is authenticated but does not verify that the user holds the required role or capability for the requested action. This gap allows any authenticated user, including a subscriber or customer role, to invoke functionality intended for administrators or shop managers.
Missing authorization in a WooCommerce pricing plugin can expose wholesale pricing rules, discount tiers, and customer group configurations. An attacker abusing this flaw can alter pricing logic, disclose business-sensitive pricing data to unauthorized roles, or disrupt store operations.
Root Cause
The root cause is the absence of current_user_can() capability checks and, likely, missing nonce validation via check_admin_referer() or wp_verify_nonce() in plugin handlers. Under CWE-862, the software performs an action without verifying that the actor has the necessary permissions. Refer to the Patchstack Vulnerability Report for detailed advisory information.
Attack Vector
An attacker requires a low-privileged authenticated account on the target WordPress site. This is trivial to obtain on stores that permit customer registration. The attacker then issues crafted HTTP requests to plugin endpoints, invoking actions that should be restricted to administrators. No user interaction is required beyond the attacker's own session, and the exploit is delivered over the network.
The vulnerability description does not include verified proof-of-concept code. See the Patchstack advisory for additional technical detail.
Detection Methods for CVE-2025-64285
Indicators of Compromise
- Unexpected changes to wholesale pricing rules, discount tiers, or customer group configurations in WooCommerce.
- HTTP POST requests to admin-ajax.php or plugin-specific endpoints originating from low-privilege user sessions.
- New or modified plugin settings in the WordPress options table without a corresponding administrator audit entry.
Detection Strategies
- Review WordPress and web server access logs for authenticated requests to premmerce-woocommerce-wholesale-pricing endpoints from non-administrator accounts.
- Deploy a WordPress activity log plugin to record configuration changes and correlate them with the acting user role.
- Compare current plugin configuration against a known-good baseline to detect unauthorized modifications.
Monitoring Recommendations
- Alert on privilege-sensitive actions performed by users below the shop manager role.
- Monitor HTTP 200 responses to plugin AJAX handlers issued by subscriber and customer accounts.
- Track plugin version across managed WordPress fleets to identify installations still running 1.1.10 or earlier.
How to Mitigate CVE-2025-64285
Immediate Actions Required
- Update the Premmerce Wholesale Pricing for WooCommerce plugin to a version later than 1.1.10 once released by the vendor.
- Audit existing user accounts and remove any unnecessary low-privilege accounts, particularly self-registered customers not tied to real orders.
- Review wholesale pricing configuration and restore any values altered without authorization.
Patch Information
At the time of NVD publication, the advisory indicates the issue affects versions through 1.1.10. Check the Patchstack Vulnerability Report and the plugin listing on WordPress.org for the current fixed version and apply it as soon as it becomes available.
Workarounds
- Deactivate the Premmerce Wholesale Pricing for WooCommerce plugin until a patched version is installed.
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall for requests targeting plugin actions from non-administrator sessions.
- Disable open customer registration on the WooCommerce store to reduce the pool of low-privilege accounts that can reach the vulnerable code.
# Example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate premmerce-woocommerce-wholesale-pricing
# Verify plugin status
wp plugin status premmerce-woocommerce-wholesale-pricing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
