Unauthorized Modification Flaw in AnnunciFunebri Impresa Plugin for WordPress

CVE-2025-14447

What is CVE-2025-14447?

The AnnunciFunebri Impresa plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks in the annfu_reset_options() function across all versions up to and including 4.7.0. This vulnerability permits authenticated users with Subscriber-level access or higher to delete all 29 plugin options, restoring the plugin to its default configuration. Such an incident can lead to significant disruptions and potential data loss for websites utilizing this plugin.

References