WordPress Plugin Vulnerabilities

Ultimate Store Kit Elementor Addons < 2.9.5 - Missing Authorization

Description

The Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
ultimate-store-kit
Fixed in 2.9.5

References

CVE
CVE-2025-69336
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c69805c9-7e29-470c-b501-39b64d60367c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Phat RiO - BlueRock
Verified
No
WPVDB ID
12afb014-0742-42ba-8b0b-72b1eb788032

Timeline

Publicly Published
2025-12-30 (about 6 months ago)
Added
2026-01-14 (about 5 months ago)
Last Updated
2026-01-14 (about 5 months ago)

Other

Published
Title
Published
2026-01-03
Title
Wanderland <= 1.5 - Missing Authorization
Published
2025-01-07
Title
1003 Mortgage Application <= 1.87 - Missing Authorization
Published
2025-09-22
Title
Editor Custom Color Palette <= 3.5.4 - Missing Authorization
Published
2026-02-17
Title
Business Directory Plugin < 6.4.21 - Missing Authorization to Unauthenticated Arbitrary Listing Modification
Published
2025-11-10
Title
Classified Listing – AI-Powered Classified ads & Business Directory Plugin < 5.2.1 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering