CVE-2025-4335: Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
First published: Wed May 07 2025(Updated: )
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the save_multiple_shipping_addresses() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Woocommerce Multiple Addresses | <=1.0.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4335?
CVE-2025-4335 is categorized as a Privilege Escalation vulnerability, which can potentially allow unauthorized users to gain elevated permissions.
How do I fix CVE-2025-4335?
To fix CVE-2025-4335, you should update the Woocommerce Multiple Addresses plugin to version 1.0.7.2 or later.
What versions are affected by CVE-2025-4335?
CVE-2025-4335 affects all versions of the Woocommerce Multiple Addresses plugin up to and including 1.0.7.1.
What is the impact of CVE-2025-4335 on users?
The impact of CVE-2025-4335 allows users to manipulate user meta data, potentially leading to unauthorized access and privilege escalation.
Is CVE-2025-4335 easy to exploit?
The CVE-2025-4335 vulnerability is relatively easy to exploit due to insufficient access controls on the save_multiple_shipping_addresses() function.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/woocommerce
- canonical/woocommerce multiple addresses