Overview
CVE-2025-12584 is a medium-severity vulnerability affecting the Quick View for WooCommerce plugin for WordPress. This vulnerability allows unauthenticated attackers to potentially access and extract data from private products that they should not have access to. This is due to insufficient access control checks on the wqv_popup_content AJAX endpoint.
This vulnerability affects all versions of the plugin up to and including version 2.2.17. Website owners using this plugin are strongly advised to update to the latest version as soon as possible.
Technical Details
The vulnerability resides in the way the wqv_popup_content AJAX endpoint handles requests for product data. Prior to the patch, the plugin did not adequately verify user permissions before retrieving and displaying product information. An unauthenticated attacker could craft a malicious request to this endpoint, specifying the ID of a private product, and the plugin would return the product’s data (e.g., title, description, price) even if the attacker shouldn’t have access.
The vulnerable code path allows for arbitrary product IDs to be passed, bypassing the intended access controls for private products. This allows an attacker to enumerate product IDs (e.g., by incrementing the ID) and retrieve information from private products they wouldn’t normally be able to see.
CVSS Analysis
- CVSS Score: 5.3 (Medium)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Explanation: This score reflects the fact that the vulnerability is remotely exploitable (AV:N), requires no special conditions (AC:L), no privileges (PR:N), and no user interaction (UI:N). The impact is limited to confidentiality (C:L), meaning the attacker can only read sensitive information, without being able to modify or delete it. Integrity and availability are not impacted.
Possible Impact
The exploitation of this vulnerability could have several negative impacts:
- Information Disclosure: Attackers could gain access to sensitive product information, such as pricing for exclusive products, product descriptions, or other confidential details.
- Competitive Advantage: Competitors could use this information to gain an unfair advantage in the market.
- Data Scraping: Attackers could automate the process of extracting data from private products, potentially creating a large database of sensitive information.
Mitigation or Patch Steps
The recommended course of action is to immediately update the Quick View for WooCommerce plugin to the latest version. The vulnerability has been patched in versions later than 2.2.17.
To update the plugin:
- Log in to your WordPress admin dashboard.
- Navigate to “Plugins” -> “Installed Plugins”.
- Find the “Quick View for WooCommerce” plugin.
- If an update is available, click the “Update Now” link.
If you are unable to update the plugin immediately, consider temporarily disabling the plugin until you can apply the update. This will prevent potential exploitation of the vulnerability.
References
WordPress Plugin Trac Changeset
Wordfence Threat Intelligence Report
