Platform
wordpress
Component
woocommerce-multiple-addresses
Fixed in
1.0.8
CVE-2025-4335 is a Privilege Escalation vulnerability discovered in the Woocommerce Multiple Addresses plugin for WordPress. An authenticated attacker with Subscriber-level access or higher can exploit this flaw to elevate their privileges to that of an administrator, gaining unauthorized control over the WordPress site. This vulnerability impacts versions 1.0.0 through 1.0.7.1, and a patch is expected to be released by the plugin developer.
Successful exploitation of CVE-2025-4335 allows an attacker to bypass access controls and assume the role of a WordPress administrator. This grants them complete control over the website, including the ability to modify content, install plugins, change user permissions, and access sensitive data. The potential impact extends to all data stored within the WordPress installation, including customer information, order details, and financial records. This vulnerability is particularly concerning because it requires only authenticated access, making it easier to exploit than vulnerabilities requiring anonymous access. The blast radius is significant, potentially impacting the entire WordPress site and its users.
CVE-2025-4335 was publicly disclosed on 2025-05-07. The vulnerability's ease of exploitation, combined with the widespread use of WordPress and the Woocommerce Multiple Addresses plugin, suggests a potential for active exploitation. Currently, there are no publicly available proof-of-concept exploits, but the vulnerability is being monitored. Its inclusion in the NVD is pending.
Exploit Status
EPSS
0.26% (49% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-4335 is to upgrade to a patched version of the Woocommerce Multiple Addresses plugin as soon as it becomes available. Until a patch is released, consider restricting access to administrative functions for users with Subscriber roles. Implement a Web Application Firewall (WAF) rule to block requests to the savemultipleshipping_addresses() function with suspicious user meta data. Regularly review user roles and permissions to ensure that no unauthorized users have elevated privileges. After upgrading, confirm the fix by attempting to elevate a Subscriber account to administrator privileges and verifying that the action is denied.
Actualice el plugin Woocommerce Multiple Addresses a la última versión disponible para mitigar la vulnerabilidad de escalada de privilegios. Verifique las actualizaciones disponibles en el repositorio de plugins de WordPress o en el sitio web del desarrollador. Asegúrese de realizar una copia de seguridad completa del sitio antes de aplicar cualquier actualización.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-4335 is a HIGH severity vulnerability in the Woocommerce Multiple Addresses plugin for WordPress, allowing authenticated subscribers to gain administrator privileges.
If you are using Woocommerce Multiple Addresses version 1.0.0 through 1.0.7.1, you are potentially affected by this vulnerability.
Upgrade to a patched version of the Woocommerce Multiple Addresses plugin as soon as it becomes available. Until then, restrict Subscriber access to administrative functions.
While no public exploits are currently available, the vulnerability's ease of exploitation suggests a potential for active exploitation.
Refer to the plugin developer's website or the WordPress plugin repository for the official advisory and patch release.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.