Unauthorized Data Modification in Swatchly Plugin for WooCommerce
CVE-2025-2719

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Swatchly – WooCommerce Variation Swatches For Products (product Attributes: Image Swatch, Color Swatches, Label Swatches)
Vendor
CVE Published:
10 April 2025

What is CVE-2025-2719?

The Swatchly – WooCommerce Variation Swatches for Products plugin for WordPress is susceptible to unauthorized data modification due to a lack of a capability check in the ajax_dismiss function. This vulnerability exists in versions 1.2.8 through 1.4.0, allowing authenticated users with Subscriber-level access and higher to alter option values on the site. Attackers could exploit this to manipulate configurations that could lead to site errors or unauthorized account registrations, impacting the experience of legitimate users.

Affected Version(s)

Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 <= 1.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/swatchly/tags/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenneth Dunn
.