CVE-2025-15033
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in WooCommerce versions 8.1 to 10.4.2 allows logged-in customers to access order data of guest customers on sites with a certain configuration. It has been fixed in WooCommerce 10.4.3 and in point releases for previously affected versions starting from 8.1 (fixed in 8.1.3). WooCommerce 8.0 and earlier are not affected.
Risk Assessment
Unauthorized disclosure of guest customer order data may occur, breaching confidentiality of personal data and potentially leading to legal consequences and loss of customer trust.
Recommendation
Update WooCommerce to version 10.4.3 or the appropriate point release (e.g., 8.1.3) and review the store configuration regarding guest order access.
Other vulnerabilities in WooCommerce
See all- CVE-2022-50972Critical
WooCommerce version 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter.
- CVE-2026-54807Critical
There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.
- CVE-2026-42386Critical
WooCommerce versions up to 4.5.1 contain a vulnerability for unauthenticated SQL injection in the order delivery date field.
- CVE-2026-106608High
Incorrect privilege assignment vulnerability in WooCommerce. Allows privilege escalation. Affects versions from 9.8.0 through 11.1.2.
- CVE-2026-48888High
Resource exhaustion vulnerability without limits or throttling in Automattic WooCommerce allows HTTP DoS. This affects WooCommerce versions before 11.1.0.
- CVE-2026-57777High
WooCommerce plugin by Automattic contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. Affects versions before 11.0.
- CVE-2026-49110High
In WooCommerce versions up to 3.1.4, there is a vulnerability of unauthenticated broken authentication in the Upsell Order Bump Offer feature.
- CVE-2025-49042Medium
The WooCommerce plugin by Automattic up to version 10.0.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.
- CVE-2024-1310Medium
The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.
Original NVD description (English source)
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS