CVE-2025-13666 - Helloprint <= 2.1.2 - missing authorization to unauthenticated arbitrary order s...

CVE ID : CVE-2025-13666 Published : 6 Dec 2025, 6:15 a.m. | 1 hour ago Description : The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbitrarily modify WooCommerce order statuses via the /wp-json/helloprint/v1/complete_order_from_helloprint_callback endpoint by providing a valid order reference ID. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor