CVE-2025-9286 | The Appy Pie Connect for WooCommerce plugin for WordPress is… | CVSS 9.8 CRITICAL

Description

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.

Metadata

CVE ID: CVE-2025-9286
State: PUBLISHED
Assigner: Wordfence
Reserved: 2025-08-20 21:29 UTC
Published: 2025-10-03 11:17 UTC
Last updated: 2026-04-08 16:46 UTC
Primary CWE: CWE-620
CWE-620 Unverified Password Change
Vendor / Product: hancock11 / Appy Pie Connect for WooCommerce
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
hancock11	Appy Pie Connect for WooCommerce	—	0 ≤ 1.1.2

Weakness (CWE)

CWE	Source	Description
CWE-620	cna	CWE-620 Unverified Password Change

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)