Vulnerability in Railmedia Order Tip For Woocommerce
CVE-2025-6025
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
EPSS: 0.005 (37.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Railmedia Order Tip For Woocommerce — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-6025?
- CVE-2025-6025 is a high-severity vulnerability in Railmedia Order Tip For Woocommerce, classified under CWE-602. CVSS score: 7.5/10. Published 2025-08-15.
- How severe is CVE-2025-6025?
- High severity. CVSS v3 base score is 7.5 out of 10.