CVE-2025-11741: WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosqquickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11741?
CVE-2025-11741 has a moderate severity due to information exposure vulnerabilities.
How do I fix CVE-2025-11741?
To fix CVE-2025-11741, update the WPC Smart Quick View for WooCommerce plugin to version 4.2.6 or later.
What versions of WPC Smart Quick View for WooCommerce are affected by CVE-2025-11741?
All versions of WPC Smart Quick View for WooCommerce up to and including 4.2.5 are affected by CVE-2025-11741.
What type of vulnerability is CVE-2025-11741?
CVE-2025-11741 is an information exposure vulnerability identified in the WPC Smart Quick View for WooCommerce plugin.
Who is the vendor of CVE-2025-11741?
The vendor of CVE-2025-11741 is WPC, which develops the Smart Quick View for WooCommerce plugin.