Unauthorized Data Modification in ShopEngine Elementor WooCommerce Builder Addon
CVE-2025-11888
2.7LOW
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-11888?
The ShopEngine Elementor WooCommerce Builder Addon for WordPress contains a vulnerability that allows authenticated users with Editor-level access and above to modify plugin settings by activating or deactivating licenses without proper authorization checks. This issue arises from insufficient capability verifications in the post_deactive() and post_activate() functions, affecting all versions up to and including 4.8.4.
Affected Version(s)
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution * <= 4.8.4