CVE-2025-9286

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-620

Affected software

Vendor	Product	Versions
hancock11	Appy Pie Connect for WooCommerce	<= 1.1.2

References

Timeline

Published: Oct 3, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-92879.1Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.CVE-2025-92889.1Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.CVE-2025-92894.7A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitati CVE-2025-92905.9An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handl CVE-2025-92916.5A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verif CVE-2025-92927.5A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circum CVE-2025-92938.1A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities dur CVE-2025-92944.3The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missi CVE-2025-92969.8A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action CVE-2025-92978.8A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. P CVE-2025-92989.8A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation o CVE-2025-92999.8A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the