CVE-2025-9286 - Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password

Back Back to CVE browser

CRITICAL

Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password

Published Oct 3, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 0.47%

Description

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.

Affected products

Vendor Hancock11 Product Appy Pie Connect for WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hancock11

Appy Pie Connect for WooCommerce

unaffected

Version	Status	Constraints
0	affected	<=1.1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-620

References (4)

Link	Providers	Tags
https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php
https://plugins.trac.wordpress.org/changeset/3385150/
https://wordpress.org/plugins/appy-pie-connect-for-woocommerce/
https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Wordfence

Published Oct 3, 2025

Updated Apr 8, 2026

Reserved Aug 20, 2025

Link CVE-2025-9286

CISA Vulnrichment

Updated Oct 3, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-9286

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-9286