Introduction
A single missing authorization check in the MultiLoca Multi Locations Inventory Management plugin lets attackers gain full administrative access to WooCommerce-powered e-commerce sites. Every plugin version up to and including 4.2.8 is affected. On any WordPress site running the plugin, inventory data, customer records, and business operations are at risk.
MultiLoca WooCommerce Multi Locations Inventory Management is a commercial plugin developed by Techspawn Solutions and sold through CodeCanyon. It is built for businesses that manage inventory across multiple locations in WooCommerce. E-commerce stores use it widely for advanced inventory features that WooCommerce does not offer natively.
Technical Information
The wcmlim_settings_ajax_handler function handles AJAX requests for plugin settings, and CVE-2025-9054 comes from a missing capability check inside it. A WordPress plugin function like this must verify the requester's permissions, usually with current_user_can() or a similar check. Without that check, any unauthenticated user can invoke the handler through the wp-admin/admin-ajax.php endpoint.
An attacker can send an HTTP POST request to the AJAX endpoint with the action parameter set to trigger wcmlim_settings_ajax_handler. The request body can carry arbitrary WordPress option names and values, and the vulnerable function writes them directly. The most severe exploit sets the users_can_register option to true and the default_role option to administrator. Public user registration opens, and every new user receives full administrative privileges. The result is immediate privilege escalation and site takeover.
The vulnerability is classified as CWE-862 (Missing Authorization). Public sources include no code snippets, but multiple advisories confirm the mechanism.
Affected Systems and Versions
- Product: MultiLoca WooCommerce Multi Locations Inventory Management plugin for WordPress
- Affected versions: All versions up to and including 4.2.8
- Vulnerable configuration: Any WordPress installation with the affected plugin version active
Vendor Security History
Techspawn Solutions, the developer of MultiLoca, provides documentation and support for the plugin, but little public information exists about its security response history. Missing authorization checks in AJAX handlers are a common flaw in WordPress plugin development. Attackers have exploited similar vulnerabilities in other WordPress plugins, often compromising sites quickly.
