by Kastro
Paper/Archive/CVE-2025-2266

CVE-2025-2266

mestresdowp Checkout Mestres do WP for WooCommerce — Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Affected

ProductAffectedFixed inSource
Checkout Mestres do WP for WooCommerce8.6.5 – 8.7.5–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/9834fd5b-8445-4c6f-95f9-f0df785c65f8?source=cverefwordpress.org/plugins/checkout-mestres-wprefplugins.trac.wordpress.org/browser/checkout-mestres-wp/trunk/backend/core/base/ajax.php#L31