CVE-2025-2266
Published: 29 March 2025
Summary
CVE-2025-2266 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-2266 is a high-severity vulnerability in the Checkout Mestres do WP for WooCommerce plugin for WordPress, affecting versions 8.6.5 through 8.7.5. It stems from a missing capability check in the cwmpUpdateOptions() function, enabling unauthorized modification of data that results in privilege escalation. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization), published on 2025-03-29.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction. By calling the vulnerable function, they can update arbitrary WordPress site options, such as changing the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register with administrative privileges, achieving full site compromise including high confidentiality, integrity, and availability impacts.
Advisories and related resources, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/9834fd5b-8445-4c6f-95f9-f0df785c65f8?source=cve, the plugin's WordPress.org page at https://wordpress.org/plugins/checkout-mestres-wp/, and vulnerable code at https://plugins.trac.wordpress.org/browser/checkout-mestres-wp/trunk/backend/core/base/ajax.php#L31, offer details on detection and remediation for affected sites.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8675
Vulnerability details
The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes…
more
it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote unauthenticated exploitation of a public-facing WordPress plugin (T1190) resulting in privilege escalation via unauthorized option modification to grant admin access (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly preventing unauthorized modification of WordPress options due to the missing capability check in cwmpUpdateOptions().
AC-6 applies least privilege to limit unauthorized access and privilege escalation via arbitrary updates like changing default registration roles to administrator.
CM-6 secures configuration settings against unauthorized changes, mitigating exploitation that alters critical WordPress options such as user registration and default roles.