Tuesday, April 29, 2025
HomeComputer Security4 Million Shops Installed WooCommerce Plugin RCE Flaw Allows Attacker to Gain...

4 Million Shops Installed WooCommerce Plugin RCE Flaw Allows Attacker to Gain WordPress Sites Admin Access

Published on

SIEM as a Service

Follow Us on Google News

WordPress based E-commerce websites that powered by E-commerce plugin WooCommerce contains Critical Remote code execution vulnerability that allows nor managers to gain admin-level privilege in WordPress websites.

WooCommerce is very popular E-commerce plugin for WordPress that installed more than 4 million users to help for small to large-sized online merchants for WordPress based E-commerce.

A file deletion vulnerability was discovered in WooCommerce that leads to escalating the privileges in WordPress online store & allows shop manager to delete certain files and gain the complete admin privilege.

- Advertisement - Google News

An unpatched design flaw in WordPress site one of the reasons that this vulnerability to perform privilege escalation and take over the complete admin access.

According to the researchers, “Arbitrary file deletion vulnerabilities aren’t considered critical in most cases as the only thing an attacker can cause is a Denial of Service by deleting the index.php of the website.”

In order to perform successful admin access, the attacker must be having a role of shop manager who can be employees of the store that can manage orders, products, and customers.

Cybercriminals gain these access using various attack methods such as XSS vulnerabilities or phishing attacks.

WooCommerce RCE Flaw Working Method

Basically shop manager roles allowed to perform certain limited access such as Read Private post, Edit users, Edit posts and this access will be allocated when Administrator install the WooCommerce plugin.

It will be reflected in WordPress core settings that means it works even after admin disable the plugin.

In order to ensure that only privileged users can access the edit another user, its calls tocurrent_user_can() a function which means (Can the user trying to perform this action edit the specific user with the ID $target_user_id?).

According to the Ripstech, “By default the edit_users capability allows users who have this privilege, e.g. shop managers, to edit any user, even administrators and perform actions such as updating their passwords. For security reasons, WooCommerce needs to specify that shop managers should be able to edit users, but only those with the customer role.”

To perform this operation plugins such as WooCommerce can add meta capabilities and it works only when the plugin is active.

But the problem is user roles get stored in the database so it keeps working even after disable.

it means that’ “meta privilege check” which restricts shop managers from editing administrators would not execute and the default behavior of allowing users edit_usersto edit any user, even administrators, would occur.”

So finally the hop manager will update the password of the admin account and gain the complete access of the site.

You can see Proof Video that explains how this exploit works to take over admin access.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Researchers Uncover SuperShell Payloads and Various Tools in Hacker’s Open Directories

Cybersecurity researchers at Hunt have uncovered a server hosting advanced malicious tools, including SuperShell...

Cyber Espionage Campaign Targets Uyghur Exiles with Trojanized Language Software

A sophisticated cyberattack targeted senior members of the World Uyghur Congress (WUC), the largest...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions – Technical Details Revealed

A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting...

Critical Linux Kernel Flaw (CVE-2025-21756) Allows Privilege Escalation

A newly disclosed vulnerability in the Linux kernel, tracked as CVE-2025-21756 and dubbed “Attack of the...

CISA Adds Broadcom Brocade Fabric OS Flaw to Known Exploited Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security advisory...