CVE-2025-4597 Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

🗓️ 30 May 2025 11:15:08Reported by WordfenceType

Vulnerability in Woo Slider Pro allows Subscriber-level users to delete arbitrary posts due to missing authorization.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-4597	30 May 202512:37	–	circl
CNNVD	WordPress plugin Woo Slider Pro – Drag Drop Slider Builder For WooCommerce 安全漏洞	30 May 202500:00	–	cnnvd
CVE	CVE-2025-4597	30 May 202511:15	–	cve
EUVD	EUVD-2025-16476	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4597	30 May 202512:15	–	nvd
Patchstack	WordPress Woo Slider Pro - Drag Drop Slider Builder For WooCommerce plugin <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via woo_slide_pro_delete_draft_preview vulnerability	30 May 202506:52	–	patchstack
Positive Technologies	PT-2025-23279 · WordPress · Woo Slider Pro	30 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4597	1 Jun 202511:43	–	redhatcve
Vulnrichment	CVE-2025-4597 Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	30 May 202511:15	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 26, 2025 to June 1, 2025)	5 Jun 202515:31	–	wordfence

[
  {
    "vendor": "bc2018",
    "product": "Woo Slider Pro – Drag Drop Slider Builder For WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.12",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1eaee0f6-968c-4004-83e7-f79baf3ff88d
plugins	www.plugins.trac.wordpress.org/browser/woo-slider-pro-drag-drop-slider-builder-for-woocommerce/trunk/inc/actions.php

08 Apr 2026 16:40Current

CVSS 3.16.5

EPSS0.00168

CWE-862