CVE-2025-5813 is a missing authorization vulnerability in the Amazon Products to WooCommerce plugin for WordPress. Specifically, the function wcta2w_get_amazon_product_callback() lacks a capability check, allowing unauthenticated attackers to add new products to the WooCommerce store. This affects all versions up to and including 1.2.7. The vulnerability is remotely exploitable without any privileges or user interaction, leading to unauthorized data modification (product creation). The CVSS score of 5.3 reflects a medium severity impact primarily on integrity. No patch or vendor advisory has been provided to date.

An attacker can remotely create new products in the WooCommerce store without authentication, leading to unauthorized modification of store data. This could result in the insertion of malicious or fraudulent products, potentially impacting the integrity of the e-commerce platform. There is no direct confidentiality or availability impact reported. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring plugin updates from the vendor is recommended to apply any forthcoming patches promptly.