CVE-2025-11741

WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.

We have discovered 3,278 live websites that are affected by CVE-2025-11741.

Run a Free Instant Scan



Affected Software

Product  Woo Smart Quick View
Category Wordpress Plugins
Vulnerable Domains3,278 live websites (44% of Woo Smart Quick View install base)
Vulnerable Versions
  • from 0 through 4.2.5
Vulnerable Versions Count93 versions ( 95% of all versions)


Common Weakness Enumeration

CWE-639 Authorization Bypass Through User-Controlled Key



Details

  • Published - Oct 18, 2025
  • Updated - Apr 8, 2026

Credits

  • Lucas Montes (finder)

Website Distribution by Country

Number of websites using CVE-2025-11741
United States814 websites


India214 websites
Germany183 websites
GB169 websites
Italy169 websites
France150 websites
Turkey137 websites
Spain90 websites
Poland78 websites
Romania63 websites

Website Distribution by TLD

Number of websites using CVE-2025-11741
.com1,555 websites
.it130 websites
.net75 websites
.co.uk69 websites
.org68 websites
.fr62 websites
.pl56 websites
.com.br55 websites
.ru48 websites
.de42 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-11741

Top websites that are affected by CVE-2025-11741. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.net France**,***
************.***.au Australia***,***
*********.com Germany***,***
***********.com United States***,***
**************.com United States***,***
*********.com United States***,***
******************.com United States***,***
********.***********.com Germany*,***,***
***********.************.com United States*,***,***
********************.com United States*,***,***
See full domain list

FAQ

CVE-2025-11741 is Authorization Bypass Through User-Controlled Key in Woo Smart Quick View
A total of 3,278 websites have been identified as vulnerable to CVE-2025-11741, based on global website indexing conducted by WebTechSurvey.
The Woo Smart Quick View is affected by the CVE-2025-11741 vulnerability.
Woo Smart Quick View versions up to and including 4.2.5 are vulnerable to CVE-2025-11741.