CVE-2025-69093

MediumCVSS 5.3

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.

Risk Assessment

An attacker may gain access to administrative functions without authorization, potentially leading to unauthorized changes to automations or order data.

Recommendation

Update the ShopMagic plugin to the latest available version that includes the security fix.

Other vulnerabilities in ShopMagic

CVE-2025-59578Medium
The ShopMagic plugin for WooCommerce up to version 4.5.6 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

Original NVD description (English source)

Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS