Unauthenticated Input Validation Flaw in WooCommerce Plugin by WordPress

CVE-2025-6025

What is CVE-2025-6025?

The Order Tip for WooCommerce plugin for WordPress exhibits a serious vulnerability due to improper input validation on the data-tip attribute. This flaw allows unsophisticated attackers to bypass authentication, enabling them to submit arbitrary tip amounts—potentially negative or exaggerated. Consequently, this could allow unauthorized discounts, including the possibility of acquiring orders for free, based on the manipulated values submitted. The issue exists in all versions of the plugin up to and including 1.5.4.

References