CVE-2025-15484
Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
| Vendor | unknown |
| Product | order notification for woocommerce |
| Published | Apr 1, 2026 |
| Last Updated | Apr 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown order notification for woocommerce
Be the first to know when new critical vulnerabilities affecting unknown order notification for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Order Notification for WooCommerce
0 < 3.6.3
References
Credits
Khaled Alenazi (Nxploited) WPScan