CVE-2025-47649 HIGH

CVE-2025-47649: WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability

Vendor Stackwc
Product Open Close WooCommerce Store
Weakness CWE-35
Published May 7, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.

Explanation of Vulnerability in Simple Terms

02Summary

Open Close WooCommerce Store versions up to 4.9.9 contain a vulnerability allowing authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The flaw requires a valid user account but no special interaction. Site administrators should update immediately to a version newer than 4.9.9.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt the site's availability.

Potential impact on your site

04Site Impact

Authenticated users can access confidential information, alter store data, or cause downtime.

Conditions required to exploit

05Prerequisites

Attacker needs a valid user account with low-level privileges.

Key dates

06Disclosure timeline

May 7, 2025 CVE published
April 28, 2026 Record updated