What the vulnerability does
01Description
The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbitrarily modify WooCommerce order statuses via the /wp-json/helloprint/v1/complete_order_from_helloprint_callback endpoint by providing a valid order reference ID.
Explanation of Vulnerability in Simple Terms
02Summary
The Helloprint WooCommerce plugin versions 2.1.2 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data through the plugin's API endpoints. No authentication is required to exploit this vulnerability. Site owners should update to a version newer than 2.1.2 to prevent unauthorized changes to plugin-managed content.
What an attacker can do
03Attacker Capabilities
Modify plugin data without logging in or having any account on the site.
Potential impact on your site
04Site Impact
Attackers can alter print product configurations, orders, or settings managed by the Helloprint plugin without authorization.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 6, 2025
CVE published
April 8, 2026
Record updated
