CVE-2025-29001mediumCWE-862

CVE-2025-29001: medium-severity vulnerability in ZoomIt WooCommerce Shop Page Builder

WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
ZoomIt · WooCommerce Shop Page Builder
Related CVEs — ZoomIt WooCommerce Shop Page Builder

In the same product, most dangerous first.

CVE-2025-28999HIGHWordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%
References
https://patchstack.com/database/wordpress/plugin/dzs-wootable/vulnerability/wordpress-woocommerce-shop-page-builder-plugin-2-27-7-broken-access-control-vulnerability?_s_id=cve