WooCommerce Square

WooCommerce Square has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (100%).

Every one of the 2 issues recorded for WooCommerce Square has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. WooCommerce Square is installed on roughly 80,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all WooCommerce Square vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-13457

WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id

Read the full analysis

Vulnerability Records

2 records
WooCommerce Square banner
Latestv5.5.0

WooCommerce Square

WooCommerce

Author

WooCommerce

2.1(121)
42/100
Last Updated
2026-08-31 (12d ago)
Active Installs
80,000+
Downloads
5,890,081
Requires WP
6.9+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2018-01-29 (9y ago)
Requires Plugins
woocommerce

This plugin allows you to securely accept payments, synchronize sales, and seamlessly manage inventory and product data between WooCommerce and Square POS. The Square plugin is PCI and SAQ A-level compliant. Accept payments anywhere, anytime The Square plugin extends WooCommerce to allow you to accept payments via Square – including support for Apple Pay®, Google Pay, WooCommerce Subscriptions and WooCommerce Pre-Orders. Recurring customers can save payment methods and use them at checkout. Customize payment forms with automatic formatting, mobile-friendly options, and retina card icons. Manage your business all in one place Sync your product and inventory information from WooCommerce to Square, or from Square to WooCommerce — set everything up once, and whenever you make a sale, your inventory automatically updates on both platforms. If you sell mainly online, set WooCommerce as your system of record so WooCommerce pushes product name, inventory, prices, categories, and images to Square. If you sell in multiple locations and online, set Square as your system of record so Square pushes product name, inventory, prices, categories, and images to WooCommerce.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C