{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68023", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:00:59.033Z", "datePublished": "2026-02-20T15:46:35.312Z", "dateUpdated": "2026-04-28T16:14:26.560Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "addonify-compare-products", "product": "Addonify \u2013 Compare Products For WooCommerce", "vendor": "Addonify", "versions": [{"changes": [{"at": "1.1.18", "status": "unaffected"}], "lessThanOrEqual": "1.1.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:24.381Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Addonify \u2013 Compare Products For WooCommerce: from n/a through <= 1.1.17.</p>"}], "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify \u2013 Compare Products For WooCommerce: from n/a through <= 1.1.17."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:26.560Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/addonify-compare-products/vulnerability/wordpress-addonify-compare-products-for-woocommerce-plugin-1-1-17-settings-change-vulnerability?_s_id=cve"}], "title": "WordPress Addonify \u2013 Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:06:30.744140Z", "id": "CVE-2025-68023", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T18:28:20.246Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:06:30.744140Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:05:41.837Z"}}], "cna": {"title": "WordPress Addonify \u2013 Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Addonify", "product": "Addonify &#8211; Compare Products For WooCommerce", "versions": [{"status": "affected", "changes": [{"at": "1.1.18", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.1.17"}], "packageName": "addonify-compare-products", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:24.381Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/addonify-compare-products/vulnerability/wordpress-addonify-compare-products-for-woocommerce-plugin-1-1-17-settings-change-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Addonify Addonify &#8211; Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify &#8211; Compare Products For WooCommerce: from n/a through <= 1.1.17.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Addonify Addonify &#8211; Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Addonify &#8211; Compare Products For WooCommerce: from n/a through <= 1.1.17.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:55.739Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68023", "state": "PUBLISHED", "dateUpdated": "2026-04-27T18:28:20.246Z", "dateReserved": "2025-12-15T10:00:59.033Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:35.312Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Addonify Addonify \u2013 Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify \u2013 Compare Products For WooCommerce: from n/a through <= 1.1.17."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de autorizaci\u00f3n en Addonify Addonify \u2013 Compare Products For WooCommerce addonify-compare-products permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Addonify \u2013 Compare Products For WooCommerce: desde n/a hasta &lt;= 1.1.17."}], "id": "CVE-2025-68023", "lastModified": "2026-04-28T19:35:48.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-02-20T16:22:07.390", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/addonify-compare-products/vulnerability/wordpress-addonify-compare-products-for-woocommerce-plugin-1-1-17-settings-change-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.17]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.1.18,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Addonify &#8211; Compare Products For WooCommerce", "source": "cna", "vendor": "Addonify"}, "product": "addonify_&#8211;_compare_products_for_woocommerce", "vendor": "addonify"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-29T00:52:45.828114+00:00", "value": {"mitigation_remediation": ["Update the Addonify \u2013 Compare Products For WooCommerce plugin to a version newer than 1.1.17.", "Review the plugin\u2019s capability settings and ensure only administrator roles have permission to modify its configuration.", "If an update cannot be applied immediately, disable or remove the plugin to prevent unauthorized configuration changes."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Settings Modification"}, "threat_synthesis": {"affected_systems": "Addonify \u2013 Compare Products For WooCommerce plugin, versions from unknown release onwards up to and including 1.1.17, is impacted.", "description_and_impact": "The issue is a Missing Authorization vulnerability that allows an attacker to modify the Addonify \u2013 Compare Products For WooCommerce plugin settings. Without proper capability checks, any authenticated user with access to the WordPress admin area could change configuration options, potentially altering product comparison behavior, exposing data or disrupting store operations. This flaw is a classic CWE\u2011862 case of missing authorization and can facilitate privilege escalation within the WordPress site.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity vulnerability, while the EPSS score of <1% suggests a very low probability of exploitation in the wild and it is not listed in CISA KEV. The likely attack vector is via the WordPress administrative interface; an attacker with a known user account that can reach the plugin\u2019s settings page could exploit the missing authorization to change settings. In the absence of additional hardening, an attacker could elevate privileges or create a foothold for further compromise."}}}}, "created": "2026-02-23T14:45:50.464565+00:00", "updated": "2026-04-29T01:00:11.387335+00:00", "vendors": ["addonify", "addonify$PRODUCT$addonify_&#8211;_compare_products_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}