CVE-2025-24603

The Print Barcode Labels for WooCommerce plugin (a4-barcode-generator) suffers from a missing authorization vulnerability in versions up to and including 3.4.10. This broken access control issue means that functions intended for higher-privileged users lack proper permission checks, allowing unauthenticated attackers to potentially execute actions they should not be able to [1].

Exploitation does not require authentication, as the vulnerable functions are exposed without nonce or capability verification. Attackers can target any site running the affected plugin, making this suitable for large-scale automated campaigns [1].

The impact is rated as medium (CVSS 4.3) with low severity, but the flaw is trivial to exploit and could lead to unauthorized access or data manipulation. The vendor has released version 3.4.11 which addresses the issue by adding proper authorization checks [1].

Users are strongly advised to update to version 3.4.11 or later. For those unable to update immediately, apply a web application firewall rule or consult a security professional. Patchstack users can enable auto-updates for this plugin [1].