CVE-2025-67958
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| taxcloud | simple_sales_tax | From 8.3.0 (inc) to 8.3.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to perform privileged actions within the WooCommerce TaxCloud plugin, potentially leading to unauthorized access or manipulation of tax-related data or settings. This poses a moderate risk to the security and integrity of your e-commerce system until the plugin is updated to version 8.4.0 or later where the issue is fixed. [1]
Can you explain this vulnerability to me?
CVE-2025-67958 is a medium severity Broken Access Control vulnerability in the TaxCloud for WooCommerce plugin (versions up to 8.3.8). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows unauthenticated users to perform actions that should be restricted to higher privileged users. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for unauthorized access attempts or suspicious activity targeting the TaxCloud for WooCommerce plugin, especially attempts to invoke functions without proper authorization. Patchstack provides a rule to block attacks targeting this vulnerability, which can also be used to detect exploitation attempts. Specific commands are not provided in the resources, but enabling Patchstack's monitoring and automatic updates can help detect and prevent exploitation. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the TaxCloud for WooCommerce plugin to version 8.4.0 or later, which includes a fix for the broken access control issue. Additionally, users of Patchstack can enable the provided mitigation rule to block attacks targeting this vulnerability and enable automatic updates for vulnerable plugins to ensure timely protection. [1]