CVE-2025-13666

🗓️ 06 Dec 2025 05:49:27Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Helloprint WordPress plugin up to 2.1.2 allows unauthenticated order status changes via a REST endpoint.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-13666	6 Dec 202509:18	–	circl
CNNVD	WordPress plugin Helloprint 安全漏洞	6 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-13666 Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification	6 Dec 202505:49	–	cvelist
EUVD	EUVD-2025-201528	6 Dec 202506:30	–	euvd
NVD	CVE-2025-13666	6 Dec 202506:15	–	nvd
Patchstack	WordPress Helloprint plugin <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification vulnerability	5 Dec 202523:59	–	patchstack
Positive Technologies	PT-2025-49345	6 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-13666	7 Dec 202506:05	–	redhatcve
Vulnrichment	CVE-2025-13666 Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification	6 Dec 202505:49	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 1, 2025 to December 7, 2025)	11 Dec 202517:00	–	wordfence

Vulners

Node

helloprint plug_your_woocommerce_into_the_largest_catalog_of_customized_print_products_from_helloprintRange≤2.1.2wordpress

[
  {
    "vendor": "helloprint",
    "product": "Plug your WooCommerce into the largest catalog of customized print products from Helloprint",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/helloprint/trunk/includes/Base/Controllers/Admin/OrderController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4b07ed75-6ee3-4a1a-b165-439a9135b059
plugins	www.plugins.trac.wordpress.org/browser/helloprint/tags/2.1.2/includes/Base/Controllers/Admin/OrderController.php

Parameter	Position	Path	Description	CWE
order_reference_id	request body	/wp-json/helloprint/v1/complete_order_from_helloprint_callback	Unauthenticated modification of WooCommerce order status via a public REST endpoint (CWE-862) by providing a valid order reference ID.	CWE-862

15 Apr 2026 00:35Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.3

EPSS0.00106

SSVC

CWE-862