Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2025-68023 is a medium priority vulnerability in the WordPress plugin "Addonify – Compare Products For WooCommerce" versions up to and including 1.1.17.'}, {'type': 'paragraph', 'content': 'The vulnerability is a "Settings Change" issue caused by broken access control, meaning that unauthorized users can improperly change plugin settings.'}, {'type': 'paragraph', 'content': 'This is related to incorrectly configured access control security levels, allowing exploitation by unauthenticated users.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated users to change the settings of the Addonify – Compare Products For WooCommerce plugin.

Improper changes to plugin settings can lead to security risks, potentially affecting the functionality and security posture of your WooCommerce site.

Because the vulnerability has a CVSS score of 6.5, it is considered moderately severe and has a reasonable likelihood of exploitation.

Exploitation could result in unauthorized configuration changes that might compromise site behavior or security.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized changes to plugin settings due to broken access control in the Addonify – Compare Products For WooCommerce plugin up to version 1.1.17.

Detection can focus on monitoring for unauthorized access attempts or changes to the plugin settings, especially from unauthenticated users.

While no specific commands are provided, general approaches include:

• Reviewing web server logs for suspicious POST requests targeting the Addonify plugin endpoints.
• Using WordPress security plugins or monitoring tools to detect unauthorized configuration changes.
• Employing network intrusion detection systems (IDS) with rules that identify attempts to exploit this vulnerability, such as those provided by Patchstack.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation step is to update the Addonify – Compare Products For WooCommerce plugin to version 1.1.18 or later, where this vulnerability is patched.

Until the update can be applied, users can apply mitigation rules provided by Patchstack that block attacks targeting this vulnerability.

Additionally, enabling automatic updates for the plugin can help ensure rapid protection against this and similar vulnerabilities.

Useful 0 Not Useful 0