CVE-2025-29001
BaseFortify
Publication date: 2025-07-04
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization issue in the ZoomIt WooCommerce Shop Page Builder plugin (up to version 2.27.7). It is a Broken Access Control vulnerability where certain plugin functions lack proper authorization, authentication, or nonce token checks. This flaw allows users with low privileges (Subscriber level) to perform actions that should be restricted to higher-privileged roles. [1]
How can this vulnerability impact me? :
The vulnerability can allow low-privileged users to perform unauthorized actions within the WooCommerce Shop Page Builder plugin, potentially leading to unauthorized modifications or changes in the shop page setup. Although the risk is considered low and exploitation unlikely to be widespread, it can still compromise the integrity of the shop page management and affect site security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unauthorized actions performed by users with Subscriber-level privileges that should require higher privileges. Since the vulnerability is due to missing authorization checks in certain plugin functions, reviewing access logs for suspicious activity related to the WooCommerce Shop Page Builder plugin may help. No specific detection commands are provided. Users should monitor plugin activity and audit user actions for anomalies. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) offered by Patchstack, which provides automatic protection against this vulnerability despite the absence of an official patch. Additionally, monitoring for updates from the plugin developer and restricting Subscriber-level user capabilities where possible can help reduce risk. [1]