{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6730", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-26T15:16:33.726Z", "datePublished": "2025-07-29T09:23:45.239Z", "dateUpdated": "2026-04-08T16:47:26.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:26.424Z"}, "affected": [{"vendor": "amans2k", "product": "Bonanza \u2013 WooCommerce Free Gifts Lite", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Bonanza \u2013 WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success."}], "title": "Bonanza \u2013 WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bonanza-woocommerce-free-gifts-lite/trunk/xl/includes/class-xl-opt-in-manager.php#L244"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phong Nguyen"}], "timeline": [{"time": "2025-07-28T20:26:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-29T13:45:40.777958Z", "id": "CVE-2025-6730", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:45:47.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6730", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-29T13:45:40.777958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:45:43.797Z"}}], "cna": {"title": "Bonanza \u2013 WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success", "credits": [{"lang": "en", "type": "finder", "value": "Phong Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "amans2k", "product": "Bonanza \u2013 WooCommerce Free Gifts Lite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-28T20:26:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bonanza-woocommerce-free-gifts-lite/trunk/xl/includes/class-xl-opt-in-manager.php#L244"}], "descriptions": [{"lang": "en", "value": "The Bonanza \u2013 WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:26.424Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6730", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:26.424Z", "dateReserved": "2025-06-26T15:16:33.726Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-29T09:23:45.239Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Bonanza \u2013 WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success."}, {"lang": "es", "value": "El complemento Bonanza \u2013 WooCommerce Free Gifts Lite para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n xlo_optin_call() en todas las versiones hasta la 1.0.0 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, configuren la suscripci\u00f3n como correcta."}], "id": "CVE-2025-6730", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-29T10:15:29.680", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bonanza-woocommerce-free-gifts-lite/trunk/xl/includes/class-xl-opt-in-manager.php#L244"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T06:06:31.779705+00:00", "value": {"mitigation_remediation": ["Update the Bonanza \u2013 WooCommerce Free Gifts Lite plugin to the latest available version that includes the access control fix.", "If an update is not immediately possible, disable or remove the opt\u2011in feature or otherwise prevent the xlo_optin_call() function from being invoked until a fix is applied.", "Review and tighten the role capabilities of Subscriber-level users on the site, ensuring they cannot perform privileged plugin configuration actions."], "summary": {"action": "Patch", "impact": "Unauthorized data modification by authenticated WordPress users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects WordPress sites that have the Bonanza \u2013 WooCommerce Free Gifts Lite plugin installed at any version up to and including 1.0.0, released by Amans2k.", "description_and_impact": "The Bonanza \u2013 WooCommerce Free Gifts Lite plugin contains a missing capability check in the xlo_optin_call() function, which is a CWE-862 Broken Access Control flaw. Authenticated WordPress users with Subscriber-level or higher permissions can invoke the function to set the opt\u2011in status to success. This does not allow code execution but enables an attacker to alter the plugin\u2019s configuration state, potentially changing how free gifts are presented or awarded and thereby compromising the integrity of promotional data.", "risk_and_exploitability": "The CVSS score of 4.3 reflects moderate severity, while the EPSS score being less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the issue requires a logged\u2011in user with at least Subscriber rights, the attack vector is restricted to authenticated users, limiting the potential impact to sites that mismanage user roles or have overly permissive Subscriber capabilities."}}}}, "created": "2025-07-30T11:10:28.290919+00:00", "updated": "2026-04-22T06:15:10.427150+00:00", "vendors": ["woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}