CVE-2025-15033: WooCommerce 8.1.0 to before 8.1.3, 8.2.0 to before 8.2.4, 8.3.0 to before 8.3.3, 8.4.0 to before 8.4.2, 8.5.0 to…

Affected technology

WooCommerce · 8.1.0 to before 8.1.3, 8.2.0 to before 8.2.4, 8.3.0 to before 8.3.3, 8.4.0 to before 8.4.2, 8.5.0 to before 8.5.4, 8.6.0 to before 8.6.3, 8.7.0 to before 8.7.2, 8.8.0 to before 8.8.6, 8.9.0 to before 8.9.4, 9.0.0 to before 9.0.3, 9.1.0 to before 9.1.5, 9.2.0 to before 9.2.4, 9.3.0 to before 9.3.5, 9.4.0 to before 9.4.4, 9.5.0 to before 9.5.3, 9.6.0 to before 9.6.3, 9.7.0 to before 9.7.2, 9.8.0 to before 9.8.6, 9.9.0 to before 9.9.6, 10.0.0 to before 10.0.5, 10.1.0 to before 10.1.3, 10.2.0 to before 10.2.3, 10.3.0 to before 10.3.7, 10.4.0 to before 10.4.3
Automattic

Description’s affected range: 8.1 to 10.4.2 can

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.