CVE-2025-6025CWE-602

Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts

High · published August 15, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.1th percentile
Weakness
CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2025-08-15T02:24Z
EPSS history
Timeline
  • 15 AUG 02:24Z
    Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
    cvelistv5