Platform
wordpress
Component
woocommerce
Fixed in
8.1.3
8.2.4
8.3.3
8.4.2
8.5.4
8.6.3
8.7.2
8.8.6
8.9.4
9.0.3
9.1.5
9.2.4
9.3.5
9.4.4
9.5.3
9.6.3
9.7.2
9.8.6
9.9.6
10.0.5
10.1.3
10.2.3
10.3.7
10.4.3
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
10.0.5
CVE-2025-15033 represents a Sensitive Information Exposure vulnerability affecting the WooCommerce plugin for WordPress. An authenticated attacker, possessing Subscriber-level access or higher, can exploit this flaw to extract sensitive user or configuration data. This vulnerability impacts WooCommerce versions from 10.0 up to and including 10.4.2. A patch is available in version 10.0.5.
The primary impact of CVE-2025-15033 is the potential exposure of sensitive data stored within the WooCommerce plugin. Attackers with Subscriber privileges or greater can leverage this vulnerability to access information that could compromise user accounts, payment details, or other critical configuration settings. This could lead to identity theft, financial fraud, or unauthorized access to the WordPress site's backend. The blast radius extends to all users and administrators of the affected WordPress site, as well as any third-party services integrated with WooCommerce. While requiring authentication, the relatively low privilege level needed (Subscriber) makes this vulnerability particularly concerning, as many users have this level of access. The extracted data could be used for further attacks, such as phishing campaigns targeting specific users or attempts to escalate privileges within the WordPress environment.
CVE-2025-15033 was published on December 22, 2025. The EPSS score is pending evaluation, but the requirement for authenticated access with Subscriber privileges suggests a medium probability of exploitation. No public Proof-of-Concept (POC) exploits have been publicly disclosed at the time of writing, but the relatively straightforward nature of the vulnerability could lead to the development of such exploits. Monitor security advisories from WordPress and WooCommerce for updates and potential exploitation campaigns.
Exploit Status
EPSS
0.03% (7% percentile)
CVSS Vector
The primary mitigation for CVE-2025-15033 is to immediately upgrade the WooCommerce plugin to version 10.0.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While no direct WAF rules can prevent the underlying vulnerability, implementing strict access controls and limiting user privileges can reduce the attack surface. Regularly review user roles and permissions to ensure only necessary access is granted. Monitor WooCommerce logs for suspicious activity, particularly attempts to access sensitive data. If rollback is necessary after an upgrade, carefully test the previous version in a staging environment before reverting to production. After upgrading to version 10.0.5, confirm the fix by attempting to access sensitive data through the plugin's administrative interface – the access should be denied.
Update to one of the following versions, or a newer patched version: 10.0.5, 10.1.3, 10.2.3, 10.3.7, 8.1.3, 8.2.4, 8.3.3, 8.4.2, 8.5.4, 8.6.3, 8.7.2, 8.8.6, 8.9.4, 9.0.3, 9.1.5, 9.2.4, 9.3.5, 9.4.4, 9.5.3, 9.6.3, 9.7.2, 9.8.6, 9.9.6
Vulnerability analysis and critical alerts directly to your inbox.
It's a vulnerability in WooCommerce allowing authenticated users (Subscriber level or higher) to extract sensitive data like user details and configuration settings.
If you're running WooCommerce versions 10.0 through 10.4.2 on your WordPress site, you are potentially affected.
Upgrade your WooCommerce plugin to version 10.0.5 or later to resolve the vulnerability. If immediate upgrade isn't possible, implement stricter access controls.
No public exploits have been disclosed, but the vulnerability's nature suggests a potential for exploitation. Monitor security advisories.
Refer to the official WordPress and WooCommerce security advisories, as well as the National Vulnerability Database (NVD) entry for CVE-2025-15033.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.