Unauthenticated Input Validation Flaw in WooCommerce Plugin by WordPress

CVE-2025-6025

What is CVE-2025-6025?

The Order Tip for WooCommerce plugin for WordPress exhibits a serious vulnerability due to improper input validation on the data-tip attribute. This flaw allows unsophisticated attackers to bypass authentication, enabling them to submit arbitrary tip amounts—potentially negative or exaggerated. Consequently, this could allow unauthorized discounts, including the possibility of acquiring orders for free, based on the manipulated values submitted. The issue exists in all versions of the plugin up to and including 1.5.4.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References