CVE-2025-1284: Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xcwooprinterpreview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1284?
CVE-2025-1284 has a high severity level due to its Insecure Direct Object Reference vulnerability.
How do I fix CVE-2025-1284?
To fix CVE-2025-1284, update the Woocommerce Automatic Order Printing plugin to version 4.2 or later.
Where is CVE-2025-1284 located in the Woocommerce plugin?
CVE-2025-1284 is located in the xc_woo_printer_preview AJAX action.
Who is affected by CVE-2025-1284?
All users of Woocommerce Automatic Order Printing plugin versions up to and including 4.1 are affected by CVE-2025-1284.
What types of attacks can exploit CVE-2025-1284?
CVE-2025-1284 can lead to unauthorized access to sensitive information through improper handling of user input.