CVE-2025-9054

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

• CWE-862

• https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586#item-description__changelog
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=cve

Published

Sep 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9047A vulnerability has been found in projectworlds Visitor Mana…9.8
• CVE-2025-9048The Wptobe-memberships plugin for WordPress is vulnerable to…8.1
• CVE-2025-9050A vulnerability was found in projectworlds Travel Management…9.8
• CVE-2025-9051A vulnerability was determined in projectworlds Travel Manag…9.8
• CVE-2025-9052A vulnerability was identified in projectworlds Travel Manag…9.8
• CVE-2025-9053A vulnerability has been found in projectworlds Travel Manag…9.8
• CVE-2025-9055The VAPIX Edge storage API that allowed a privilege escalati…6.4
• CVE-2025-9056Unprotected service in the AudioLink component allows a loca…5.3
• CVE-2025-9057The Biagiotti Core plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-9058The Mikado Core plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-9059The Altiris Core Agent Updater package (AeXNSC.exe) is prone…8.8
• CVE-2025-9060A vulnerability has been found in the  MSoft MFlash applic…9.1