WordPress Plugin Vulnerabilities

Addonify – Compare Products For WooCommerce < 1.1.18 - Missing Authorization to Unauthenticated Settings Update

Description

The Addonify – Compare Products For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.17. This makes it possible for unauthenticated attackers to update plugin settings.

Affects Plugins

Plugin icon
addonify-compare-products
Fixed in 1.1.18

References

CVE
CVE-2025-68023
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cedf147d-82ba-41f2-b30a-1befedf8694a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
5def94ac-a4ec-4ebf-ab32-d998cef84dea

Timeline

Publicly Published
2026-02-04 (about 8 months ago)
Added
2026-02-09 (about 8 months ago)
Last Updated
2026-02-16 (about 8 months ago)

Other

Published
Title
Published
2025-12-11
Title
PDF for Contact Form 7 + Drag and Drop Template Builder < 6.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication
Published
2025-06-19
Title
Zara 4 Image Compression <= 1.2.17.2 - Missing Authorization
Published
2025-01-07
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.12 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-01-30
Title
WordPress Review & Structure Data Schema Plugin – Review Schema < 2.2.0 - Missing Authorization to Arbitrary Review Update
Published
2025-07-22
Title
LoginWP - Pro < 4.0.8.6 - Missing Authorization to Unauthenticated Settings Update