CVE-2025-22673

Vulnerability

Missing Authorization vulnerability in WPFactory EAN for WooCommerce (slug: ean-for-woocommerce) allows exploiting incorrectly configured access control security levels. The issue affects all versions from n/a through 5.3.5. The plugin has been closed/removed from the WordPress.org plugin directory as of April 27, 2026, pending a full review, meaning no patched version is distributed via that channel [1].

Exploitation

An attacker needs network access to the WooCommerce installation. No authentication or special privileges are explicitly required for exploitation per the available references; the vulnerability lies in incorrectly configured access control levels, potentially allowing any user to trigger unauthorized actions. The exact attack vector is not detailed in the references [1].

Impact

Successful exploitation could lead to unauthorized access or privilege escalation, compromising the confidentiality, integrity, or availability of data managed by the plugin. The attacker may gain ability to execute actions that should require higher privileges, such as reading or modifying sensitive inventory data, though the specific CIA outcome is not fully disclosed [1].

Mitigation

No patched version is currently available; the plugin has been removed from WordPress.org, and users are advised to uninstall it immediately. The closure is temporary pending a full review, but no fixed release date is known. Users should consider disabling or removing the plugin until a secure version is re-published [1].