ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution, CVE-2025-10173

CVE, Research URL: CVE-2025-10173
Home page URL: Security reports for ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Application: ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Published on: Sep 26, 2025
Research Description: The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Affected versions: max 4.8.4.
Status: vulnerable