Unauthorized Access and Data Loss in Sweet Energy Efficiency Plugin for WordPress

CVE-2025-14618

What is CVE-2025-14618?

The Sweet Energy Efficiency plugin for WordPress is susceptible to unauthorized access due to a lack of capability checks in its AJAX handler. This vulnerability allows authenticated attackers, even those with minimal subscriber-level permissions, to interact with and manipulate data, including reading, modifying, and deleting arbitrary graphs. The issue affects all versions of the plugin up to and including version 1.0.6, posing significant risks for users who have this plugin installed.

References