CVE-2025-59578

MediumCVSS 5.8

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The ShopMagic plugin for WooCommerce up to version 4.5.6 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

Risk Assessment

Sensitive data could be exposed during transmission, potentially leading to information leakage and compromise of the store's security.

Recommendation

Update the ShopMagic plugin to a version newer than 4.5.6 and review configurations for secure data transmission.

Other vulnerabilities in ShopMagic

CVE-2025-69093Medium
The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS