Missing Authorization Vulnerability in Eyewear Prescription Form Plugin for WordPress
CVE-2025-14365
5.3MEDIUM
What is CVE-2025-14365?
The Eyewear Prescription Form plugin for WordPress allows unauthenticated users to exploit a missing authorization check in the RemoveItems AJAX action. This vulnerability enables attackers to delete arbitrary WooCommerce product categories, including their associated child categories, by manipulating the 'catIds' parameter. All versions prior to 6.0.1 are susceptible to this issue, making it crucial for site administrators to implement necessary security measures.
Affected Version(s)
Eyewear prescription form * <= 6.0.1
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Athiwat Tiprasaharn
Itthidej Aramsri
Powpy
Peerapat Samatathanyakorn