CVE-2025-15033: WooCommerce - Subscriber/Customer+ Order Data Disclosure
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15033?
CVE-2025-15033 is classified as a high severity vulnerability affecting WooCommerce versions 8.1 to 10.4.2.
How do I fix CVE-2025-15033?
To fix CVE-2025-15033, update your WooCommerce plugin to version 10.4.3 or later.
Who is affected by CVE-2025-15033?
CVE-2025-15033 affects WooCommerce users who have versions from 8.1 to 10.4.2 installed and allows logged-in customers access to guest order data.
What is the impact of CVE-2025-15033?
The impact of CVE-2025-15033 allows authenticated users to improperly access sensitive order information of guest customers.
Is there a specific configuration needed for CVE-2025-15033 to be exploited?
Yes, CVE-2025-15033 can be exploited on sites with specific configurations that allow logged-in customers to access data.