Overview
CVE-2025-13441 is a medium severity vulnerability affecting the “Hide Category by User Role for WooCommerce” plugin for WordPress. This vulnerability allows unauthenticated attackers to flush the site’s object cache, potentially leading to performance degradation or other unintended consequences. The vulnerability exists in all versions up to and including 2.3.1.
Technical Details
The vulnerability stems from a missing authorization check on the admin_init hook within the plugin. Specifically, the wp_cache_flush() function is executed without verifying if the user has the necessary capabilities. This means that an unauthenticated attacker can craft a malicious request to trigger the admin_init hook, leading to the execution of wp_cache_flush() and subsequently, the clearing of the website’s object cache.
The vulnerable code is located within the admin/admin-ui-setup.php file.
CVSS Analysis
- CVSS Score: 5.3 (Medium)
- The CVSS score reflects the potential impact of the vulnerability. While not directly leading to data compromise, the ability to flush the cache can degrade site performance, potentially impacting user experience and SEO.
Possible Impact
Successful exploitation of this vulnerability can lead to the following:
- Performance Degradation: Frequent cache flushing can significantly slow down the website, as content needs to be re-generated on each request.
- Increased Server Load: The increased need to regenerate content places a higher load on the server, potentially leading to resource exhaustion.
- Denial of Service (DoS): Under heavy load, the server might become unresponsive, effectively denying service to legitimate users.
Mitigation and Patch Steps
The recommended mitigation is to update the “Hide Category by User Role for WooCommerce” plugin to a version higher than 2.3.1. The vulnerability has been addressed in subsequent releases. Check for updates within your WordPress dashboard.
- Log in to your WordPress administration panel.
- Navigate to “Plugins” -> “Installed Plugins”.
- Locate the “Hide Category by User Role for WooCommerce” plugin.
- If an update is available, click the “Update Now” link.
- Verify that the updated version is greater than 2.3.1.
