CVE-2025-13441
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-27

Last updated on: 2025-11-27

Assigner: Wordfence

Description
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This makes it possible for unauthenticated attackers to flush the site's object cache via forged requests, potentially degrading site performance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-27
Last Modified
2025-11-27
Generated
2026-07-06
AI Q&A
2025-11-27
EPSS Evaluated
2026-07-05
NVD
CVE-2025-13441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce woocommerce *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the Hide Category by User Role for WooCommerce plugin for WordPress is a Missing Authorization issue. It occurs because the plugin does not properly check user capabilities on the admin_init hook before executing the wp_cache_flush() function. This allows unauthenticated attackers to send forged requests that flush the site's object cache.

Impact Analysis

This vulnerability can allow unauthenticated attackers to flush the site's object cache, which can degrade site performance. While it does not directly compromise data confidentiality or availability, the performance degradation could affect user experience and site reliability.

Mitigation Strategies

Update the Hide Category by User Role for WooCommerce plugin to a version later than 2.3.1 where the missing authorization check is fixed. Until then, restrict access to the admin_init hook or disable the plugin to prevent unauthenticated cache flush requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart