WordPress Plugin Vulnerabilities

FraudLabs Pro for WooCommerce < 2.22.12 - Missing Authorization

Description

The FraudLabs Pro for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.22.11. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
fraudlabs-pro-for-woocommerce
Fixed in 2.22.12

References

CVE
CVE-2025-49320
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7a71b7e0-0562-4832-ab83-45ba1af57f1c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
bd9b3f99-e405-49f7-ac94-edb731f0f187

Timeline

Publicly Published
2025-06-05 (about 1 year ago)
Added
2025-06-10 (about 1 year ago)
Last Updated
2025-06-10 (about 1 year ago)

Other

Published
Title
Published
2026-01-25
Title
TOP Table Of Contents < 1.4.0 - Missing Authorization
Published
2026-03-16
Title
Jobica Core <= 1.4.2 - Missing Authorization
Published
2025-04-24
Title
Bulk Assign Linked Products For WooCommerce <= 2.1 - Missing Authorization
Published
2026-07-07
Title
WP Booking System – Booking Calendar Premium < 5.12.8.1 - Missing Authorization
Published
2026-02-23
Title
SiteGuard WP Plugin < 1.7.10 - Missing Authorization