CVE-2025-11888

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update

View on CVE.org

Published Oct 25, 2025 CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Description

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.

Analysis

Technical impact

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is compromised by an insufficient capability check in the post_deactivate() and post_activate() functions in all releases up to 4.8.4. This flaw permits an authenticated attacker with Editor-level access or higher to toggle the license status of the plugin, effectively enabling or disabling license protection without proper authorization. The vulnerability represents a classic example of insufficient authorization (CWE‑863) and could allow attackers to bypass licensing restrictions, potentially leading to unauthorized use of premium features.

Affected Systems

The affected installation is the ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress, specifically versions 4.8.4 and earlier. Any WordPress site that has installed these versions and grants Editor or higher roles to users is at risk.

Risk and Exploitability

With a CVSS score of 2.7, the weakness poses a low overall risk; the EPSS score of less than 1 % indicates that actual exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Nevertheless, the attack requires only an authenticated account with Editor privileges or higher, making the barrier to exploitation relatively low in environments where such roles are widely granted.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

roxnor

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.8.4

No data.

Vendor	Product	Versions
Elementor	Elementor	—
Roxnor	Shopengine Elementor Woocommerce Builder Addon	—
Woocommerce	Woocommerce	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the ShopEngine plugin to version 4.8.5 or later, which addresses the capability check issue
If an upgrade is not immediately possible, restrict Editor and higher roles from the post_deactivate() and post_activate() functions using a role‑management plugin or custom code that removes the necessary capability
Enable logging or monitoring of license activation and deactivation events to detect unauthorized changes and alert administrators

Generated by OpenCVE AI on April 22, 2026 at 12:37 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.223% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3381211/shopengine/tags/4.8.5/libs/license/license-route.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdadc84-0cfb-4bec-aeb9-f59f205d269b?source=cve

History

Oct 27, 2025 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Elementor Elementor elementor Roxnor Roxnor shopengine Elementor Woocommerce Builder Addon Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress
Vendors & Products		Elementor Elementor elementor Roxnor Roxnor shopengine Elementor Woocommerce Builder Addon Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress

Oct 27, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2025 5:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
Title		ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Weaknesses		CWE-863
References		https://plugins.trac.wordpress.org/changeset/3381211/shopengine/tags/4.8.5/libs/license/license-route.php https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdadc84-0cfb-4bec-aeb9-f59f205d269b?source=cve
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}`