CVE-2025-67599: WebToffee Email Customizer Auth Bypass

CVE-2025-67599 Overview

CVE-2025-67599 is a missing authorization vulnerability in the WebToffee eCommerce Marketing Automation plugin for WordPress (decorator-woocommerce-email-customizer). The flaw affects all versions up to and including 2.1.1. An authenticated attacker with low privileges can exploit incorrectly configured access control levels to interact with plugin functions that should be restricted to higher-privileged roles. The weakness maps to CWE-862: Missing Authorization.

Critical Impact

Authenticated users with minimal privileges can access plugin functionality intended for administrators, enabling limited disclosure of information managed by the marketing automation plugin.

Affected Products

• WebToffee eCommerce Marketing Automation plugin for WordPress
• Plugin slug: decorator-woocommerce-email-customizer
• All versions from n/a through <= 2.1.1

Discovery Timeline

• 2025-12-09 - CVE-2025-67599 published to the National Vulnerability Database
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2025-67599

Vulnerability Analysis

The plugin exposes one or more actions that lack a proper authorization check. The code path verifies that a request is authenticated but does not confirm that the caller holds the required capability or role before executing the sensitive operation. Any logged-in user, including a Subscriber or Customer account, can invoke the affected endpoint over the network.

The impact is bounded by the CVSS vector: confidentiality is partially affected, while integrity and availability are not. In practical terms, the attacker can read or trigger plugin behavior that should be gated by administrative capabilities within WooCommerce marketing automation workflows.

Root Cause

The root cause is a missing capability check in the plugin's request handlers. WordPress plugins must call current_user_can() with an appropriate capability (for example, manage_woocommerce or manage_options) before executing privileged logic. The affected handlers rely only on nonce validation or authentication state, which does not restrict access by role.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privileged account. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint, such as an admin-ajax.php action or a REST route registered by the plugin. Because no capability check runs, the server processes the request and returns data or performs the action. No user interaction is required beyond the attacker submitting the request.

Refer to the Patchstack Vulnerability Report for the exact affected handler.

Detection Methods for CVE-2025-67599

Indicators of Compromise

• Requests to plugin-registered admin-ajax.php actions or REST routes from accounts with Subscriber, Customer, or Shop Customer roles
• Unexpected 200 responses to plugin endpoints originating from low-privileged session cookies
• Access logs showing repeated calls to decorator-woocommerce-email-customizer routes outside administrator sessions

Detection Strategies

• Audit WordPress access logs for POST and GET requests to plugin handlers correlated with non-administrative user IDs
• Enable WooCommerce and WordPress audit logging to record capability-sensitive actions and compare with the user's assigned role
• Deploy a web application firewall rule that denies plugin endpoint access when the authenticated role does not include manage_woocommerce

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for role-versus-endpoint correlation
• Alert on new or modified user accounts followed shortly by access to WooCommerce plugin administrative endpoints
• Track plugin version inventory across sites to confirm the vulnerable 2.1.1 build is no longer present

How to Mitigate CVE-2025-67599

Immediate Actions Required

• Update the WebToffee eCommerce Marketing Automation plugin to a version later than 2.1.1 when the vendor publishes a fix
• Review and remove unused low-privileged accounts that could be abused to reach the vulnerable endpoint
• Restrict access to /wp-admin/admin-ajax.php and plugin REST routes using a web application firewall where feasible

Patch Information

At the time of publication, the NVD entry references the Patchstack Vulnerability Report as the authoritative source. Site operators should monitor the WordPress plugin repository for a release above 2.1.1 that adds the missing capability checks.

Workarounds

• Temporarily disable the decorator-woocommerce-email-customizer plugin until a patched version is installed
• Enforce role-based firewall or reverse-proxy rules that block Subscriber or Customer accounts from reaching plugin administrative endpoints
• Disable new user self-registration on the affected WordPress site to reduce the pool of accounts that can authenticate

# Example: block plugin AJAX actions for non-admins at the reverse proxy
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^wt_email_customizer_") {
        # Require an admin session cookie set by your auth layer
        if ($cookie_wp_role != "administrator") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass php;
}