CVE-2025-12955

The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394241%40live-sales-notifications-for-woocommerce&old=3389540%40live-sales-notifications-for-woocommerce&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12945A vulnerability in NETGEAR Nighthawk R7000P routers lets an …7.2
• CVE-2025-12946A vulnerability in the speedtest feature of affected NETGEAR…7.5
• CVE-2025-1295The Templines Elementor Helper Core plugin for WordPress is …8.8
• CVE-2025-12952A privilege escalation vulnerability exists in Google Cloud'…8.7
• CVE-2025-12953The Classified Listing – AI-Powered Classified ads & Busines…4.3
• CVE-2025-12954The Timetable and Event Schedule by MotoPress WordPress plug…2.7
• CVE-2025-12956A reflected Cross-site Scripting (XSS) vulnerability affecti…5.4
• CVE-2025-12957The All-in-One Video Gallery plugin for WordPress is vulnera…8.8
• CVE-2025-12958The Rankology SEO and Analytics Tool plugin for WordPress is…2.7
• CVE-2025-1296Nomad Community and Nomad Enterprise (“Nomad”) are vulnerabl…6.5
• CVE-2025-12960The Simple CSV Table plugin for WordPress is vulnerable to D…6.5
• CVE-2025-12961The Download Panel plugin for WordPress is vulnerable to una…4.3