{"id":79367,"date":"2025-09-30T03:57:52","date_gmt":"2025-09-30T03:57:52","guid":{"rendered":""},"modified":"2025-10-04T08:34:44","modified_gmt":"2025-10-04T14:34:44","slug":"cve-2025-9054-unauthorized-data-modification-vulnerability-in-woocommerce-multi-locations-inventory-management-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-9054-unauthorized-data-modification-vulnerability-in-woocommerce-multi-locations-inventory-management-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-9054: Unauthorized Data Modification Vulnerability in WooCommerce Multi Locations Inventory Management Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A high-severity vulnerability, dubbed CVE-2025-9054, has been discovered in the MultiLoca – WooCommerce Multi Locations Inventory Management plugin, a popular inventory management plugin for WordPress websites. This vulnerability could allow an unauthenticated attacker to modify data, leading to privilege escalation. Any website that utilizes this plugin for inventory management<\/a> and is running a version up to, and including, 4.2.8 is at risk.
\nThis vulnerability matters because it can lead to a complete system<\/a> compromise or significant data leakage. Given the popularity of WordPress and the widespread use of WooCommerce plugins<\/a>, the potential attack vector is massive. The severity of the vulnerability<\/a>, combined with the potential impact, necessitates immediate action from all affected users.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-9054
\nSeverity: Critical (9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Unauthorized modification of data, privilege escalation<\/a>, potential system compromise, and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

MultiLoca – WooCommerce Multi Locations Inventory Management plugin for WordPress<\/a> | Up to and including 4.2.8<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability stems from a missing<\/a> capability check on the ‘wcmlim_settings_ajax_handler’ function in the affected versions of the plugin. This absence means that unauthenticated attackers can update arbitrary options on the WordPress<\/a> site without requiring any privileges or user interaction. An attacker can leverage this vulnerability to update the default<\/a> role for registration to administrator and enable user registration. This would allow the attacker to register as an administrator and gain full access to the vulnerable<\/a> site.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=wcmlim_settings_ajax_handler HTTP\/1.1\nHost: vulnerable-website.com\nContent-Type: application\/x-www-form-urlencoded\nwcmlim_options[default_role]=administrator&wcmlim_options[user_registration]=1<\/code><\/pre>\n
In this example, the attacker sends an HTTP POST request to the ‘admin-ajax.php’ file with the ‘wcmlim_settings_ajax_handler’ action. They then modify the ‘default_role’ and ‘user_registration’ options, setting the default role to ‘administrator’ and enabling user registration.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A high-severity vulnerability, dubbed CVE-2025-9054, has been discovered in the MultiLoca – WooCommerce Multi Locations Inventory Management plugin, a popular inventory management plugin for WordPress websites. This vulnerability could allow an unauthenticated attacker to modify data, leading to privilege escalation. Any website that utilizes this plugin for inventory management and is running a version […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-79367","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t