CVE-2025-15033

WooCommerce - Subscriber/Customer+ Order Data Disclosure

State: Published
Severity: 6.5 Medium
Published: Dec 22, 2025
Updated: Mar 6, 2026
Reserved: Dec 22, 2025

Description

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
WooCommerceAutomattic	8.1.0 to before 8.1.3Affected 8.2.0 to before 8.2.4Affected 8.3.0 to before 8.3.3Affected 8.4.0 to before 8.4.2Affected 8.5.0 to before 8.5.4Affected 8.6.0 to before 8.6.3Affected 8.7.0 to before 8.7.2Affected 8.8.0 to before 8.8.6Affected 8.9.0 to before 8.9.4Affected 9.0.0 to before 9.0.3Affected 9.1.0 to before 9.1.5Affected 9.2.0 to before 9.2.4Affected 9.3.0 to before 9.3.5Affected 9.4.0 to before 9.4.4Affected 9.5.0 to before 9.5.3Affected 9.6.0 to before 9.6.3Affected 9.7.0 to before 9.7.2Affected 9.8.0 to before 9.8.6Affected 9.9.0 to before 9.9.6Affected 10.0.0 to before 10.0.5Affected 10.1.0 to before 10.1.3Affected 10.2.0 to before 10.2.3Affected 10.3.0 to before 10.3.7Affected 10.4.0 to before 10.4.3Affected

Product

Versions

WooCommerceAutomattic

8.1.0 to before 8.1.3Affected
8.2.0 to before 8.2.4Affected
8.3.0 to before 8.3.3Affected
8.4.0 to before 8.4.2Affected
8.5.0 to before 8.5.4Affected
8.6.0 to before 8.6.3Affected
8.7.0 to before 8.7.2Affected
8.8.0 to before 8.8.6Affected
8.9.0 to before 8.9.4Affected
9.0.0 to before 9.0.3Affected
9.1.0 to before 9.1.5Affected
9.2.0 to before 9.2.4Affected
9.3.0 to before 9.3.5Affected
9.4.0 to before 9.4.4Affected
9.5.0 to before 9.5.3Affected
9.6.0 to before 9.6.3Affected
9.7.0 to before 9.7.2Affected
9.8.0 to before 9.8.6Affected
9.9.0 to before 9.9.6Affected
10.0.0 to before 10.0.5Affected
10.1.0 to before 10.1.3Affected
10.2.0 to before 10.2.3Affected
10.3.0 to before 10.3.7Affected
10.4.0 to before 10.4.3Affected

References

https://wpscan.com/vulnerability/f55fd7d3-7fbe-474f-9406-f47f8aee5e57/exploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.