BaseFortify

Publication date: 2025-11-11

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11457

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	wordpress	*
easycommerce	easycommerce	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the EasyCommerce WordPress plugin versions 0.9.0-beta2 to 1.5.0. It allows unauthenticated attackers to escalate their privileges by exploiting the /easycommerce/v1/orders REST API endpoint, which does not properly restrict users from selecting roles during registration. As a result, attackers can gain administrator-level access to the affected site.

Impact Analysis

If exploited, this vulnerability can allow an attacker to gain administrator-level access to your WordPress site running the vulnerable EasyCommerce plugin. This means the attacker could fully control the site, including modifying content, stealing data, installing malicious code, or disrupting site operations.

Hi! I’m here to help you understand CVE-2025-11457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70