CVE-2025-66071: WooCommerce Order Numbers Auth Bypass

CVE-2025-66071 Overview

CVE-2025-66071 is a missing authorization vulnerability [CWE-862] in the Tyche Softwares Custom Order Numbers for WooCommerce WordPress plugin. The flaw affects all versions up to and including 1.11.0. Attackers can exploit incorrectly configured access control security levels to perform actions without proper authorization checks. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction. Exploitation impacts the integrity of affected WooCommerce stores by allowing unauthorized modifications tied to order number functionality.

Critical Impact
Unauthenticated attackers can abuse missing authorization checks in the plugin to perform actions restricted to higher-privileged users, affecting store integrity.

Affected Products

Tyche Softwares Custom Order Numbers for WooCommerce plugin
All versions from n/a through 1.11.0
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-11-21 - CVE-2025-66071 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66071

Vulnerability Analysis

The vulnerability stems from missing authorization checks [CWE-862] within the Custom Order Numbers for WooCommerce plugin. The plugin exposes functionality without verifying whether the requesting user holds the appropriate role or capability. Attackers can reach these endpoints over the network without authentication or user interaction.

Successful exploitation affects integrity only. Confidentiality and availability are not impacted, according to the published CVSS vector. The EPSS probability is 0.306% at percentile 22.686, indicating limited observed exploitation activity at this time. The scope of impact is limited to functionality exposed by the plugin, including order number configuration and related administrative actions.

Root Cause

The plugin fails to apply capability or nonce validation on one or more of its handlers. In WordPress plugins, this pattern typically occurs when a function registered via admin_post_, wp_ajax_, or a REST route omits calls such as current_user_can() or check_admin_referer(). Without these checks, the handler executes for any requester, including unauthenticated visitors.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a target WordPress site. Because no authentication or privilege check is performed, the request executes with the plugin's intended privilege level. Attackers can automate discovery by scanning WordPress sites for the plugin fingerprint and issuing requests to the affected handler. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-66071

Indicators of Compromise

Unexpected modifications to WooCommerce order number sequences or formats in the WordPress database.
Access log entries showing unauthenticated POST requests to admin-ajax.php or admin-post.php referencing plugin actions.
Plugin option changes in wp_options without a corresponding administrator session.

Detection Strategies

Inventory WordPress sites and identify installations of custom-order-numbers-for-woocommerce at version 1.11.0 or earlier.
Review web server logs for anonymous requests hitting plugin AJAX or admin-post handlers.
Monitor plugin-related option keys for unauthorized writes.

Monitoring Recommendations

Enable WordPress audit logging to capture option and settings changes with user attribution.
Alert on HTTP requests to plugin endpoints originating outside expected administrator IP ranges.
Track anomalies in WooCommerce order number issuance patterns.

How to Mitigate CVE-2025-66071

Immediate Actions Required

Update Custom Order Numbers for WooCommerce to a version later than 1.11.0 once the vendor publishes a fix.
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php at the web application firewall (WAF) where feasible.
Audit WooCommerce order records and plugin settings for unauthorized changes.

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Report for the latest fixed version guidance from Tyche Softwares.

Workarounds

Deactivate the plugin until a patched version is available if order number customization is not business-critical.
Deploy WAF rules blocking unauthenticated requests to the plugin's AJAX and admin-post actions.
Enforce IP allowlists on WordPress administrative endpoints.

bash

# Example WAF rule concept: block unauthenticated POSTs to plugin actions
# ModSecurity-style pseudo rule
SecRule REQUEST_URI "@rx /wp-admin/admin-(ajax|post)\.php" \
  "chain,deny,status:403,id:1000066071,msg:'Block unauth CVE-2025-66071 attempts'"
  SecRule ARGS:action "@rx custom[_-]order[_-]numbers" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"