CVE-2025-6025 – WooCommerce Order Tip Improper Input Validation Vulnerability

CVE ID : CVE-2025-6025

Published : Aug. 15, 2025, 3:15 a.m. | 54 minutes ago

Description : The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…