CVE-2025-58656
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | estonian_shipping_methods_for_woocommerce | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58656 is a Sensitive Data Exposure vulnerability in the Estonian Shipping Methods for WooCommerce Plugin (versions up to 1.7.2). It involves the use of hard-coded credentials that allow unauthenticated attackers to retrieve embedded sensitive data that should normally be restricted. This vulnerability falls under the OWASP Top 10 category A2: Cryptographic Failures and has a low severity rating with a CVSS score of 5.3. The plugin is abandoned and unpatched, so the risk remains unless mitigated by virtual patching or replacing the plugin. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to access sensitive information embedded in the plugin, which could lead to further exploitation of other system weaknesses. Since the plugin is abandoned and unpatched, the risk persists, potentially exposing sensitive data to unauthorized parties. Simply deactivating the plugin does not remove the risk unless a virtual patch is applied. Users are advised to replace the plugin or use virtual patching to mitigate the risk. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include replacing the Estonian Shipping Methods for WooCommerce plugin (version 1.7.2 or earlier) with an alternative solution, as the plugin is abandoned and unpatched. Simply deactivating the plugin does not eliminate the risk. Applying a virtual patch (vPatch) offered by Patchstack is recommended to provide immediate protection by auto-mitigating the vulnerability without requiring an official fix. [1]