CVE-2026-25443
Published: 19 March 2026
Summary
CVE-2026-25443 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to system resources in accordance with applicable access control policies, directly preventing unauthenticated arbitrary content deletion.
Requires timely identification, reporting, and correction of flaws such as this missing authorization vulnerability through patching the affected plugin versions.
Defines specific actions permitted without identification or authentication, ensuring destructive operations like content deletion are not accessible to unauthenticated attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote unauthenticated exploitation of the application (T1190) and arbitrary content deletion causing availability impact (T1485 Data Destruction).
NVD Description
Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.3.
Deeper analysisAI
CVE-2026-25443 is a missing authorization vulnerability (CWE-862) in the Fraud Prevention for WooCommerce WordPress plugin, identified as woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers. It enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 2.3.3. The issue was published on 2026-03-19 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting a high-impact denial of service potential with no confidentiality or integrity effects.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows arbitrary content deletion, leading to significant availability disruptions for affected WordPress sites running vulnerable plugin versions.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/vulnerability/wordpress-fraud-prevention-for-woocommerce-plugin-2-3-2-arbitrary-content-deletion-vulnerability?_s_id=cve details the arbitrary content deletion issue in version 2.3.2 and recommends mitigation by updating to a version beyond 2.3.3 where the access control flaw is addressed.
Details
- CWE(s)