What is CVE-2025-15033?

CVE-2025-15033 is a medium-severity vulnerability in Automattic Woocommerce, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-12-22.

How severe is CVE-2025-15033?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Automattic Woocommerce

CVE-2025-15033

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

Vulnerability class: Information Disclosure

EPSS: 0.003 (22.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Automattic Woocommerce — versions 8.1.0, 8.2.0, 8.3.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2025-15033?: CVE-2025-15033 is a medium-severity vulnerability in Automattic Woocommerce, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-12-22.
How severe is CVE-2025-15033?: Medium severity. CVSS v3 base score is 6.5 out of 10.