Vulnerability details

CVE-2025-3906

felipe152 Integração entre Eduzz e Woocommerce

Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

CVSS 3.1

8.8High

Official description

The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_opcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the default registration role within the plugin's registration flow to Administrator, which allows any user to create an Administrator account.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CVEProject cvelistV5 (CNA) (Wordfence)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
felipe152	Integração entre Eduzz e Woocommerce	v ≤ 1.7.5	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-04-26
Last updated: 2026-04-08
State: Published
Assigner (CNA): Wordfence

Exploit prediction (EPSS)

0.46%

Probability of exploitation in 30 days

40.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-862
Missing Authorization