Description

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T07:16:46.373Z",
  "pubdate": "2026-09-11T07:16:46.373Z",
  "executiveSummary": "The advanced-customized-prompts WordPress plugin, versions 1.0.1 and below, contains a critical security flaw involving insecure direct object references (IDOR) and insufficient access control.\nThe vulnerability manifests as an improper authorization check during the processing of WooCommerce order item metadata updates.\nAny authenticated user, including those with minimal privileges such as a subscriber, can modify order metadata for arbitrary orders belonging to other customers.\nThis represents a significant integrity risk, as attackers can tamper with sensitive transactional data, potentially leading to unauthorized modification of order details, shipping information, or metadata used for business logic.\nExploitation does not require elevated privileges or administrative access, relying solely on the ability to manipulate HTTP requests targeting the vulnerable plugin functionality.\nThe risk implication is severe, as it undermines the confidentiality and integrity of the WooCommerce order management ecosystem by bypassing standard WordPress capability checks and nonce verification protocols.",
  "technicalDetails": "The root cause of this vulnerability is the absence of comprehensive access control mechanisms within the plugin's metadata update handler. Specifically, the component responsible for processing WooCommerce order item metadata updates fails to perform capability checks (e.g., current_user_can), ownership validation, or cryptographic nonce verification.\nIn a secure implementation, an endpoint performing write operations on order-related data must verify that the requesting user possesses the 'manage_woocommerce' or 'edit_shop_order' capability. Furthermore, the application should validate that the authenticated user is authorized to modify the specific order ID provided in the request body.\nThe exploitation method involves an attacker intercepting or crafting an HTTP request directed at the plugin's metadata modification endpoint. Since the plugin performs no validation, the attacker can supply an arbitrary order ID and a payload containing malicious or modified metadata values.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the WordPress instance as a low-privileged user (subscriber). 2) The attacker identifies the vulnerable endpoint responsible for updating order metadata. 3) The attacker constructs a request targeting a target order ID belonging to a different customer. 4) The attacker injects the desired metadata modifications into the payload. 5) The server-side code processes the request without verifying permissions or nonces, committing the changes to the database. 6) The order metadata is successfully altered, reflecting the attacker's input.\nThis vulnerability is classified as an authorization bypass. Because the plugin logic blindly trusts the input provided in the request, it creates a vector for widespread data corruption. The impact is significant: an attacker could potentially manipulate order fulfillment workflows, inject malicious data into administrative logs, or facilitate fraudulent activity by altering metadata attributes that downstream processes rely upon.\nThe lack of nonce validation also implies that the endpoint is susceptible to Cross-Site Request Forgery (CSRF) in addition to the direct authorization bypass, as there is no token-based defense to ensure the request originated from a legitimate administrative session. Affected versions include all instances of advanced-customized-prompts up to and including 1.0.1."
}