CVE-2025-60159

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Nota Fiscal Eletrônica WooCommerce plugin up to version 3.4.0.9 has missing authorization, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized access may allow an attacker to manipulate invoices or tax data, potentially leading to financial fraud or legal violations.

Recommendation

Update the Nota Fiscal Eletrônica WooCommerce plugin to a version newer than 3.4.0.9. Review and fix access control configuration.

Other vulnerabilities in Nota Fiscal Eletrônica WooCommerce

CVE-2025-60158Medium
Stored Cross-Site Scripting (XSS) vulnerability in Nota Fiscal Eletrônica WooCommerce (versions up to 3.4.0.9) due to improper input neutralization during web page generation.

Original NVD description (English source)

Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nota Fiscal Eletrônica WooCommerce: from n/a through <= 3.4.0.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS