CVE-2025-46244 is a medium severity missing authorization flaw (CVSS 5.3) in the Dotstore plugin Advanced Linked Variations for WooCommerce, versions through 1.0.3. The record names no fixed version. Update to a release newer than 1.0.3 if one exists, check the Patchstack entry, or remove the plugin.
What's affected
The record lists Advanced Linked Variations for WooCommerce, slug linked-variation, from the earliest release through version 1.0.3 inclusive. The record's wording, taken from Patchstack, is that the issue allows exploiting incorrectly configured access control security levels.
The record does not state a fixed version. A release newer than 1.0.3 is the likely route to a fix, but confirm that the plugin's changelog or the Patchstack entry says the access check was added.
How to check if you're exposed
Check the plugin version on each WordPress site.
- In the WordPress admin, open Plugins and read the version next to Advanced Linked Variations for WooCommerce.
- With WP-CLI, run the command shown below on each site.
- For many sites, run the command shown below in a loop over your site paths.
- Compare the result with 1.0.3. Anything at or below it is in the affected range.
If you manage plugins through Composer, search your composer.lock for the plugin's package name instead.
Commands referred to above, in order:
wp plugin list --name=linked-variation --fields=name,version,status
wp plugin get linked-variation --field=version
What to do now
- List every WordPress site that has the plugin installed, active or not.
- Update the plugin to the newest release and read its changelog for an access control fix.
- If no fixed release exists, deactivate and delete the plugin, since an inactive plugin's files can still sit on the server.
- Review which product data on your shop is edited through the plugin and check for unexpected changes.
- Turn on automatic updates for plugins that touch your product catalogue, if your process allows it.
- Re-scan the site after the change to confirm the old version is gone.
Why it matters
The record lists CWE-862 (Missing Authorization). Missing authorization means that a function checks who you are, or nothing at all, but does not check whether you are allowed to use it. A request that should need a privileged role is accepted from someone who should not be able to make it.
The vector (AV:N, AC:L, PR:N, UI:N) shows a network attack with no login, and integrity impact is rated low, which keeps the score at 5.3. Low rated plugin flaws still deserve a patch, because they are cheap to find and easy to automate. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Which versions are affected?
The record says the plugin is affected from the earliest release through 1.0.3.
Is there a fixed version?
The record does not name one. Check the Patchstack entry and the plugin changelog.
Sources
Last reviewed: 18 October 2026.
