Overview
A high-severity vulnerability, dubbed CVE-2025-9054, has been discovered in the MultiLoca – WooCommerce Multi Locations Inventory Management plugin, a popular inventory management plugin for WordPress websites. This vulnerability could allow an unauthenticated attacker to modify data, leading to privilege escalation. Any website that utilizes this plugin for inventory management and is running a version up to, and including, 4.2.8 is at risk.
This vulnerability matters because it can lead to a complete system compromise or significant data leakage. Given the popularity of WordPress and the widespread use of WooCommerce plugins, the potential attack vector is massive. The severity of the vulnerability, combined with the potential impact, necessitates immediate action from all affected users.
Vulnerability Summary
CVE ID: CVE-2025-9054
Severity: Critical (9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized modification of data, privilege escalation, potential system compromise, and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
MultiLoca – WooCommerce Multi Locations Inventory Management plugin for WordPress | Up to and including 4.2.8
How the Exploit Works
The vulnerability stems from a missing capability check on the ‘wcmlim_settings_ajax_handler’ function in the affected versions of the plugin. This absence means that unauthenticated attackers can update arbitrary options on the WordPress site without requiring any privileges or user interaction. An attacker can leverage this vulnerability to update the default role for registration to administrator and enable user registration. This would allow the attacker to register as an administrator and gain full access to the vulnerable site.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use:
POST /wp-admin/admin-ajax.php?action=wcmlim_settings_ajax_handler HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
wcmlim_options[default_role]=administrator&wcmlim_options[user_registration]=1In this example, the attacker sends an HTTP POST request to the ‘admin-ajax.php’ file with the ‘wcmlim_settings_ajax_handler’ action. They then modify the ‘default_role’ and ‘user_registration’ options, setting the default role to ‘administrator’ and enabling user registration.
