CVE-2025-13457 Details
Description
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.
A vulnerability exists in the WooCommerce Square plugin for WordPress, affecting all versions up to and including 5.1.1. The issue is an Insecure Direct Object Reference (IDOR) in the 'get_token_by_id' function, where user-controlled keys are not properly validated. This flaw allows unauthenticated attackers to access arbitrary Square 'ccof' (credit card on file) values, which could be used to make fraudulent charges on the targeted site.
Users are advised to update the WooCommerce Square plugin to version 5.1.2 or to one of the earlier patched versions: 4.2.3, 4.3.2, 4.4.2, or 4.5.2.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 10, 2026CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WooCommerce Square | >= 4.2.0, < 4.2.3 (semver) >= 4.3.0, < 4.3.2 (semver) >= 4.4.0, < 4.4.2 (semver) >= 4.5.0, < 4.5.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 10, 2026 | New CVE Received | [email protected] |