Medium severity · published Dec 22, 2025
CVE-2025-15033
WooCommerce - Subscriber/Customer+ Order Data Disclosure
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WooCommerce · Automattic
8.1.0 before 8.1.3; 8.2.0 before 8.2.4; 8.3.0 before 8.3.3; 8.4.0 before 8.4.2; 8.5.0 before 8.5.4; 8.6.0 before 8.6.3; +18 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15033
wpscan.com
https://wpscan.com/vulnerability/f55fd7d3-7fbe-474f-9406-f47f8aee5e57/
More from WooCommerce
7.6
CVE-2026-57777
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
7.5
CVE-2026-48888
WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
7.5
CVE-2026-3589
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
7.5
CVE-2017-17058
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent…
7.2
CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability