BaseFortify

Publication date: 2025-10-03

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-03

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-10-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9286

EUVD

EUVD-2025-32529

Affected Vendors & Products

Vendor	Product	Version / Range
appy_pie	connect_for_woocommerce	1.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-620	When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Appy Pie Connect for WooCommerce plugin for WordPress, where a missing authorization check in the reset_user_password() REST handler allows unauthenticated attackers to reset the passwords of arbitrary users, including administrators. This means attackers can gain administrative access without proper credentials.

Impact Analysis

The vulnerability can allow attackers to gain administrative access to your WordPress site by resetting passwords of any user, including administrators. This can lead to full control over the site, data breaches, unauthorized changes, and potential further exploitation.

Hi! I’m here to help you understand CVE-2025-9286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70