CVE-2025-29001

The WooCommerce Shop Page Builder plugin for WordPress, up to version 2.27.7, contains a Missing Authorization vulnerability. This flaw stems from an incorrectly configured access control security level, specifically a broken access control issue where a function lacks proper authorization, authentication, or nonce token checks [1].

An unauthenticated attacker can exploit this vulnerability by sending crafted requests to the affected plugin endpoint, bypassing intended privilege checks. No authentication is required, making the attack surface wide for any site running the vulnerable plugin version [1].

Successful exploitation allows an attacker to execute certain higher-privileged actions without authorization. According to the reference, vulnerabilities like this are commonly used in mass-exploit campaigns to target thousands of websites simultaneously, regardless of site popularity or traffic [1].

The plugin vendor has patched this issue in a later release; users are strongly advised to update to the latest version immediately. If updating is not possible, consulting a hosting provider or web developer for mitigation assistance is recommended [1].