CVE-2025-13441

The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This makes it possible for unauthenticated attackers to flush the site's object cache via forged requests, potentially degrading site performance.

• CWE-862

• https://plugins.trac.wordpress.org/browser/hide-category-by-user-role-for-woocommerce/tags/2.3.1/admin/admin-ui-setup.php#L165
• https://plugins.trac.wordpress.org/browser/hide-category-by-user-role-for-woocommerce/trunk/admin/admin-ui-setup.php#L165
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402760%40hide-category-by-user-role-for-woocommerce&new=3402760%40hide-category-by-user-role-for-woocommerce&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b05b0f6d-ffa4-40f4-b969-1153192c52d6?source=cve

Published

Nov 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13435A security vulnerability has been detected in Dreampie Resty…8.1
• CVE-2025-13436GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-13437When zx is invoked with --prefer-local=<path>, the CLI creat…5.6
• CVE-2025-13438The Page Title, Description & Open Graph Updater plugin for …4.3
• CVE-2025-13439The Fancy Product Designer plugin for WordPress is vulnerabl…5.9
• CVE-2025-13440The Premmerce Wishlist for WooCommerce plugin for WordPress …5.3
• CVE-2025-13442A security vulnerability has been detected in UTT 进取 750W up…9.8
• CVE-2025-13443A vulnerability was detected in macrozheng mall up to 1.0.3.…6.5
• CVE-2025-13444OS Command Injection Remote Code Execution Vulnerability in …6.8
• CVE-2025-13445A flaw has been found in Tenda AC21 16.03.08.16. This affect…9.8
• CVE-2025-13446A vulnerability has been found in Tenda AC21 16.03.08.16. Th…9.8
• CVE-2025-13447OS Command Injection Remote Code Execution Vulnerability in …6.8