CVE-2025-13457
IDOR Vulnerability in WooCommerce Square Plugin Exposes Credit Cards
Publication date: 2026-01-10
Last updated on: 2026-01-10
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| woocommerce | woocommerce_square | to 5.1.1 (inc) |
| woocommerce | woocommerce_square | 5.1.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WooCommerce Square plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 5.1.1. This occurs in the get_token_by_id function due to missing validation on a user-controlled key, allowing unauthenticated attackers to access arbitrary Square credit card on file (ccof) values. Attackers can potentially use these values to make fraudulent charges on the affected site.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to expose stored credit card information (ccof values) from the WooCommerce Square plugin. With access to these values, attackers may make fraudulent charges on the target site, leading to financial loss, reputational damage, and potential legal consequences for the site owner.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the WooCommerce Square plugin to version 5.1.2 or later, as this version includes security fixes that implement nonce verification and user authentication checks to prevent unauthorized access to payment tokens. Additionally, ensure that your WordPress and WooCommerce installations are updated to compatible versions (WordPress up to 6.9.2 and WooCommerce up to 10.4.6) as per the plugin update. These steps will prevent unauthenticated attackers from exploiting the insecure direct object reference vulnerability. [2]