CVE-2025-1284

CVSS 3.1 Score 4.3 of 10 (medium)

Details

Published Apr 24, 2025
Updated: Apr 29, 2025
CWE ID 639

Summary

CVE-2025-1284 is a vulnerability affecting the Woocommerce Automatic Order Printing plugin for WordPress. The issue, present in all versions up to 4.1, allows authenticated attackers with Subscriber-level access or higher to access and view other users' invoices and orders. This data can contain sensitive information due to an Insecure Direct Object Reference in the xc_woo_printer_preview AJAX action. The flaw arises from a missing validation check on a user-controlled key, enabling unauthorized access.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share