Introduction
A critical flaw in the Appy Pie Connect for WooCommerce plugin lets attackers reset any user's password without authenticating, which gives them administrative control of the WordPress site. For e-commerce operators and site owners, a single unauthenticated request could mean total site compromise and data loss.
Appy Pie is a global no-code platform provider that sells a wide range of website and business automation tools. Their Connect for WooCommerce plugin is a specialized integration for WordPress e-commerce deployments. The company claims SOC 2 and ISO 27001 certifications and serves thousands of customers worldwide, so vulnerabilities in their products have a large impact on the WordPress and WooCommerce ecosystem.
Technical Information
CVE-2025-9286 is a privilege escalation vulnerability in the Appy Pie Connect for WooCommerce plugin for WordPress, present in all versions up to and including 1.1.2. The vulnerable code is the reset_user_password() REST handler, implemented in the plugin's connect-woocommerce-rest-api.php file.
The handler processes password reset requests without any authentication or authorization check. It is exposed through the WordPress REST API and accepts HTTP POST requests that specify a username and a new password. Because it never verifies the requester's identity or privileges, any unauthenticated actor can send a crafted request to this endpoint and reset the password of any user, including those with administrator privileges.
This is a classic instance of CWE-620 (Unverified Password Change), where an application allows password changes without verifying the user's identity. The impact is immediate and severe. Attackers can gain full administrative access to the affected WordPress site, then install malicious plugins, exfiltrate data, or deface the site.
No public code snippets or proof-of-concept exploit code were found in the referenced sources. The vulnerable handler can be read in the plugin's source code, in connect-woocommerce-rest-api.php.
Affected Systems and Versions
- Product: Appy Pie Connect for WooCommerce plugin for WordPress
- Affected versions: All versions up to and including 1.1.2
- Vulnerable configuration: Any WordPress installation with this plugin activated and accessible REST API endpoints
Vendor Security History
Appy Pie claims SOC 2 and ISO 27001 certifications and documents standard security controls for their platform. The provided sources show no prior public record of similar vulnerabilities in this plugin. This vulnerability, however, indicates that the product's REST API endpoints did not get a secure coding review.
