Unauthorized Data Access Vulnerability in Vchasno Kasa Plugin for WordPress
CVE-2025-6721
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 July 2025
What is CVE-2025-6721?
The Vchasno Kasa plugin for WordPress is exposed to unauthorized data access due to a flaw in the mrkv_vchasno_kasa_wc_do_metabox_action() function, which lacks proper capability checking. Attackers can exploit this vulnerability to generate invoices for arbitrary orders without authentication, raising significant concerns over data security and integrity in applications utilizing the plugin.
Affected Version(s)
MORKVA Vchasno Kasa Integration * <= 1.0.3