CVE-2021-25018: najeebmedia ppom_for_woocommerce Missing Authorization
Vulnerability summary
CVE-2021-25018 is a medium (CVSS 5.4) Missing Authorization vulnerability in najeebmedia ppom_for_woocommerce. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-02-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Najeebmedia1 product
- ppom_for_woocommerce< 24.0
Unknown1 product
- ppom for woocommerce≥ 24.0, < 24.0
Wordpress1 product
- woocommerce-product-addon≤ 23.9 (fixed in 24.0)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/9e092aad-0b36-45a9-8987-8d904b34fbb2X Refsource MISCExploitThird Party Advisory