Introduction
A critical flaw in the Live Sales Notification for WooCommerce plugin lets anyone on the internet read customer names, locations, and purchase histories from thousands of WooCommerce stores. The issue affects over 20000 active WordPress sites and exposes sensitive order data directly to unauthenticated attackers.
About the Involved Software: The Live Sales Notification for WooCommerce plugin is a popular WordPress extension that shows site visitors real-time or simulated sales notifications, using social proof to increase conversions. It has over 20000 active installations and is used by WooCommerce store owners around the world. WooCommerce itself is the most popular e-commerce platform for WordPress and powers a significant portion of online stores worldwide.
Technical Information
CVE-2025-12955 is a missing authorization vulnerability (CWE-862) in the Live Sales Notification for WooCommerce plugin. In all versions up to and including 2.3.39, the plugin exposes a REST API endpoint that calls the getOrders function. That function retrieves recent order data (including customer first names, city, state, country, purchase time and date, and product details) for the sales notification popups.
The getOrders function runs no authorization or capability checks before it returns order data. Any unauthenticated user can send an HTTP request to the exposed endpoint and get sensitive customer information back. The attack needs no authentication or user interaction and works over the network. If the recent order notification feature is enabled, the vulnerability is present regardless of plugin configuration.
No public source gives the exact endpoint URL or code snippets for the vulnerable function. There is currently no information about a patch or detection methods for this vulnerability.
Affected Systems and Versions
- Product: Live Sales Notification for WooCommerce (WordPress plugin)
- Affected versions: All versions up to and including 2.3.39
- Vulnerable configuration: Any site with the plugin active and configured to display recent order information
Vendor Security History
The Live Sales Notification for WooCommerce plugin is actively maintained and gets frequent compatibility and feature updates. There is no public evidence, though, of a mature security response process or systematic vulnerability management. Similar missing authorization vulnerabilities have been reported in other WooCommerce-related plugins, which indicates a recurring problem in the ecosystem.
