{"id":79367,"date":"2025-09-30T03:57:52","date_gmt":"2025-09-30T03:57:52","guid":{"rendered":""},"modified":"2025-10-04T08:34:44","modified_gmt":"2025-10-04T14:34:44","slug":"cve-2025-9054-unauthorized-data-modification-vulnerability-in-woocommerce-multi-locations-inventory-management-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-9054-unauthorized-data-modification-vulnerability-in-woocommerce-multi-locations-inventory-management-plugin-for-wordpress\/","title":{"rendered":"<strong>CVE-2025-9054: Unauthorized Data Modification Vulnerability in WooCommerce Multi Locations Inventory Management Plugin for WordPress<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>A high-severity vulnerability, dubbed CVE-2025-9054, has been discovered in the MultiLoca &#8211; WooCommerce Multi Locations Inventory Management plugin, a popular inventory management plugin for WordPress websites. This vulnerability could allow an unauthenticated attacker to modify data, leading to privilege escalation. Any website that utilizes this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5953-privilege-escalation-through-wp-human-resource-management-plugin-vulnerability\/\"  data-wpil-monitor-id=\"91430\">plugin for inventory management<\/a> and is running a version up to, and including, 4.2.8 is at risk.<br \/>\nThis <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26210-deepseek-xss-vulnerability-allows-potential-system-compromise\/\"  data-wpil-monitor-id=\"86684\">vulnerability matters because it can lead to a complete system<\/a> compromise or significant data leakage. Given the popularity of <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-9990-wordpress-helpdesk-integration-plugin-vulnerable-to-local-file-inclusion\/\"  data-wpil-monitor-id=\"87377\">WordPress and the widespread use of WooCommerce plugins<\/a>, the potential attack vector is massive. The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-9864-high-severity-heap-corruption-vulnerability-in-google-chrome-v8-engine\/\"  data-wpil-monitor-id=\"87993\">severity of the vulnerability<\/a>, combined with the potential impact, necessitates immediate action from all affected users.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-9054<br \/>\nSeverity: Critical (9.8)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: Unauthorized modification of data, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-48543-privilege-escalation-vulnerability-in-android-s-chrome-sandbox\/\"  data-wpil-monitor-id=\"86927\">privilege escalation<\/a>, potential system compromise, and data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-3585753313\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>MultiLoca &#8211; WooCommerce Multi Locations Inventory Management <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5931-dokan-pro-plugin-for-wordpress-privilege-escalation-vulnerability\/\"  data-wpil-monitor-id=\"88872\">plugin for WordPress<\/a> | Up to and including 4.2.8<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-36897-critical-remote-code-execution-vulnerability-due-to-missing-bounds-check\/\"  data-wpil-monitor-id=\"87745\">vulnerability stems from a missing<\/a> capability check on the &#8216;wcmlim_settings_ajax_handler&#8217; function in the affected versions of the plugin. This absence means that <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8085-critical-unauthenticated-remote-code-execution-vulnerability-in-ditty-wordpress-plugin\/\"  data-wpil-monitor-id=\"87727\">unauthenticated attackers can update arbitrary options on the WordPress<\/a> site without requiring any privileges or user interaction. An attacker can leverage this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-35452-default-shared-credentials-vulnerability-in-ptzoptics-and-other-valuehd-based-cameras\/\"  data-wpil-monitor-id=\"87740\">vulnerability to update the default<\/a> role for registration to administrator and enable user registration. This would allow the attacker to register as an administrator and gain full <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-57052-cjson-out-of-bounds-access-vulnerability-and-mitigation\/\"  data-wpil-monitor-id=\"86824\">access to the vulnerable<\/a> site.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2423543368\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Below is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use:<\/p>\n<pre><code class=\"\" data-line=\"\">POST \/wp-admin\/admin-ajax.php?action=wcmlim_settings_ajax_handler HTTP\/1.1\nHost: vulnerable-website.com\nContent-Type: application\/x-www-form-urlencoded\nwcmlim_options[default_role]=administrator&amp;wcmlim_options[user_registration]=1<\/code><\/pre>\n<p>In this example, the attacker sends an HTTP POST request to the &#8216;admin-ajax.php&#8217; file with the &#8216;wcmlim_settings_ajax_handler&#8217; action. They then modify the &#8216;default_role&#8217; and &#8216;user_registration&#8217; options, setting the default role to &#8216;administrator&#8217; and enabling user registration.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview A high-severity vulnerability, dubbed CVE-2025-9054, has been discovered in the MultiLoca &#8211; WooCommerce Multi Locations Inventory Management plugin, a popular inventory management plugin for WordPress websites. This vulnerability could allow an unauthenticated attacker to modify data, leading to privilege escalation. Any website that utilizes this plugin for inventory management and is running a version [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-79367","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/79367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=79367"}],"version-history":[{"count":10,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/79367\/revisions"}],"predecessor-version":[{"id":84538,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/79367\/revisions\/84538"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=79367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=79367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=79367"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=79367"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=79367"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=79367"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=79367"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=79367"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=79367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}