WordPress Plugin Vulnerabilities

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor < 3.0.7 - Missing Authorization

Description

The Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
ultimate-store-kit
Fixed in 3.0.7

References

CVE
CVE-2026-25403
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d191211-d02b-4808-8d92-c9a906117cde

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Bao - BlueRock
Verified
No
WPVDB ID
1c147853-6e7a-442c-a5aa-dc3f663437f1

Timeline

Publicly Published
2026-07-28 (about 29 days ago)
Added
2026-08-04 (about 21 days ago)
Last Updated
2026-08-04 (about 21 days ago)

Other

Published
Title
Published
2023-11-21
Title
UserPro < 5.1.2 - Missing Authorization via multiple functions
Published
2026-06-17
Title
Simple Membership < 4.7.6 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
Published
2024-07-04
Title
Charitable < 1.8.1.8 - Missing Authorization to Unauthorized Donation
Published
2025-08-14
Title
Embedder for Google Reviews < 1.7.4 - Missing Authorization
Published
2025-11-17
Title
Live sales notification for WooCommerce < 2.3.40 - Missing Authorization to Unauthenticated Customer Data Exposure