Unauthorized Data Modification in Search, Filters & Merchandising for WooCommerce Plugin by WordPress

CVE-2025-12091

What is CVE-2025-12091?

The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable due to a missing capability check on the 'wcis_save_email' endpoint. This issue may allow authenticated attackers with Subscriber-level access or higher to deactivate the plugin and modify relevant data, potentially disrupting service functionality and leading to unauthorized changes.

References