CVE-2025-10173
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Risk Assessment
Unauthorized modification of plugin settings could lead to takeover of the store or introduction of malicious changes.
Recommendation
Immediately update the plugin to the latest version that contains the fix. Restrict access to accounts with Editor-level privileges and above.
Other vulnerabilities in ShopEngine Elementor WooCommerce Builder Addon
See all- CVE-2026-19088Medium
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before version 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
- CVE-2025-12358Medium
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. Missing nonce validation on the "post_add_to_list" function and an incorrect permissions callback in the "Api/init" function allow an unauthenticated attacker to add or remove products from a user's wishlist via a forged request if they trick a site user into clicking a link.
Original NVD description (English source)
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS