External risk intelligence

Dynamic Pricing Plugin Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-47588

This vulnerability affects a WooCommerce plugin, which is a component of a web-based e-commerce application. Such plugins are designed to be integrated into websites that are typically public-facing and accessible via the internet to facilitate customer transactions and dynamic pricing, making the attack surface commonly reachable in standard web deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical code injection vulnerability has been identified in the acowebs Dynamic Pricing With Discount Rules for WooCommerce plugin. This issue could allow attackers to execute malicious code within the affected system, potentially impacting the integrity and availability of e-commerce operations. The main concern at this stage is confirming if this specific plugin is in use.

Allows code execution via a plugin.
Impacts e-commerce, needs awareness.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges could inject malicious code into the Dynamic Pricing With Discount Rules for WooCommerce plugin. This could occur if the attacker can access a feature within the plugin that processes user-supplied input without proper sanitization, potentially allowing them to execute arbitrary commands on the server. The vulnerability could lead to a complete compromise of the affected WooCommerce site.

Requires authenticated administrator access.
Exploited through unsanitized input processing.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker with administrative privileges to inject and execute arbitrary code within the affected WooCommerce plugin. This could potentially lead to the modification or complete compromise of the website's content, functionality, and underlying server.

Plugin code and website content.
Injection through specially crafted input.
Compromise of website and server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical code injection vulnerability impacts the WooCommerce Dynamic Pricing With Discount Rules plugin. Ownership typically falls to the e-commerce platform owner or the application team responsible for managing the WooCommerce environment. The initial step is to confirm the presence and reachability of the affected plugin version, identify the business-criticality of its function, and then coordinate with the vendor or an internal development team for remediation.

E-commerce platform or application owners.
Verify plugin presence and reachability.
Coordinate vendor updates or develop a plan.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dynamic Pricing With Discount Rules for WooCommerce plugin?

It is an extension for the WooCommerce e-commerce platform that allows store owners to create complex, automated pricing and discount strategies. It is commonly used to manage sales, bulk discounts, and personalized offers for customers on WordPress-based websites.

What does Code Injection mean in the context of CVE-2025-47588?

This vulnerability, classified as CWE-94, refers to a weakness where the software fails to properly sanitize user-supplied input. Because the plugin processes this input as code, an attacker can inject and execute their own malicious instructions on the server, potentially gaining unauthorized control over the website's functions.

How is this vulnerability triggered?

An attacker must have administrative privileges to reach and interact with the vulnerable plugin feature. It is not triggered by casual, unauthenticated web traffic. The issue arises specifically when input is processed by the plugin without sufficient validation, allowing arbitrary commands to run.

Is my site at risk according to Halo Surface Signal?

Because this plugin is used for public-facing e-commerce, Halo Surface Signal flags the attack surface as likely reachable via the internet. If your WordPress site is publicly accessible, the plugin's integration into your store environment makes it a component that should be assessed for potential exposure.

Do I need to take immediate action if I run this plugin?

Your first step is to verify if you are running an affected version, specifically up to 4.5.9. Once confirmed, assess the plugin's role in your business operations. You should then coordinate with your technical team to apply official patches from the vendor or temporarily disable the plugin to prevent potential unauthorized code execution.

References

patchstack.com/database/Wordpress/Plugin/aco-woo-dynamic-pricing/vul…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.