CVE-2025-68023: Addonify Compare Products Auth Bypass

CVE-2025-68023 Overview

CVE-2025-68023 is a Missing Authorization vulnerability affecting the Addonify – Compare Products For WooCommerce WordPress plugin. This security flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized modification of plugin settings. The vulnerability stems from missing capability checks on sensitive administrative functions within the plugin.

Critical Impact

Unauthenticated attackers can potentially modify plugin settings due to missing authorization checks, leading to configuration tampering and potential disruption of WooCommerce product comparison functionality.

Affected Products

• Addonify – Compare Products For WooCommerce plugin versions up to and including 1.1.17
• WordPress installations running vulnerable versions of the plugin
• WooCommerce stores utilizing the product comparison feature

Discovery Timeline

• 2026-02-20 - CVE CVE-2025-68023 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-68023

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of this WordPress plugin, the missing authorization allows attackers to bypass intended access restrictions and modify plugin settings without proper authentication or capability verification.

The vulnerability is exploitable over the network without requiring any user interaction or prior authentication. While the impact on confidentiality and availability is limited, the ability for unauthorized users to alter plugin configuration represents a significant security concern for affected WooCommerce installations.

Root Cause

The root cause of CVE-2025-68023 lies in the absence of proper capability checks within the plugin's administrative functions. WordPress plugins are expected to verify user capabilities using functions like current_user_can() before processing sensitive requests. The Addonify – Compare Products For WooCommerce plugin failed to implement these authorization checks on certain AJAX endpoints or settings modification handlers, allowing unauthenticated users to invoke administrative functionality.

Attack Vector

The attack vector for this vulnerability is network-based, meaning attackers can exploit it remotely without physical access to the target system. The exploitation process involves:

1. Identifying WordPress installations running the vulnerable plugin version (1.1.17 or earlier)
2. Sending crafted HTTP requests to plugin endpoints that lack proper authorization checks
3. Modifying plugin settings or configurations without authentication
4. Potentially disrupting the product comparison functionality or altering display behavior

Since no verified proof-of-concept code is publicly available, the specific exploitation methodology should be referenced from the Patchstack security advisory for technical implementation details.

Detection Methods for CVE-2025-68023

Indicators of Compromise

• Unexpected changes to Addonify Compare Products plugin settings without administrator action
• Unusual HTTP POST requests to WordPress AJAX endpoints related to the plugin
• Access logs showing requests to plugin-specific endpoints from unauthenticated users
• Configuration changes that disable or alter product comparison functionality

Detection Strategies

• Monitor WordPress audit logs for unauthorized settings modifications to the Addonify plugin
• Implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting plugin endpoints
• Review server access logs for anomalous POST requests to /wp-admin/admin-ajax.php with plugin-related actions
• Deploy file integrity monitoring to detect unauthorized changes to plugin configuration files

Monitoring Recommendations

• Enable comprehensive logging for WordPress administrative actions and AJAX requests
• Configure alerts for plugin settings changes outside of normal administrative workflows
• Implement real-time monitoring for unusual traffic patterns targeting WooCommerce-related plugins
• Regularly audit installed plugin versions against known vulnerability databases

How to Mitigate CVE-2025-68023

Immediate Actions Required

• Update the Addonify – Compare Products For WooCommerce plugin to the latest patched version immediately
• Review plugin settings to ensure no unauthorized modifications have been made
• Temporarily deactivate the plugin if an immediate update is not possible
• Implement WAF rules to block unauthorized access to plugin endpoints

Patch Information

Users should update to a patched version of the Addonify – Compare Products For WooCommerce plugin that addresses this authorization vulnerability. For detailed patch information and the latest secure version, refer to the Patchstack vulnerability database.

Workarounds

• Temporarily disable the Addonify – Compare Products For WooCommerce plugin until a patch can be applied
• Implement server-level access restrictions to limit who can access WordPress administrative endpoints
• Use a WordPress security plugin to add additional capability checks and access controls
• Configure .htaccess rules to restrict access to sensitive plugin files and AJAX handlers

# Example .htaccess rule to restrict admin-ajax.php access (use with caution)
# Add to WordPress root .htaccess file
<Files admin-ajax.php>
    Order deny,allow
    Deny from all
    # Allow legitimate AJAX requests from your domain
    Allow from your-domain.com
</Files>