CVE-2025-69093
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.
Risk Assessment
An attacker may gain access to administrative functions without authorization, potentially leading to unauthorized changes to automations or order data.
Recommendation
Update the ShopMagic plugin to the latest available version that includes the security fix.
Other vulnerabilities in ShopMagic
See all- CVE-2026-114195Medium
The WP Desk ShopMagic plugin (shopmagic-for-woocommerce) has an insertion of sensitive information into an externally-accessible file or directory vulnerability, allowing retrieval of embedded sensitive data. This issue affects ShopMagic versions up to and including 4.9.1.
- CVE-2026-103367High
The ShopMagic – email automation for WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 4.9.0 via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation requires a published recipe processing the {{ customer.first_name }} placeholder — the built-in "New Order email with social media profile links" recipe satisfies this by default, making the default configuration exploitable with no account, cookie, or nonce.
- CVE-2025-59578Medium
The ShopMagic plugin for WooCommerce up to version 4.5.6 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS