CVE-2025-14365
Missing Authorization in Eyewear Plugin Allows WooCommerce Category Deletion
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | 6.0.1 |
| woocommerce | woocommerce | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in the Eyewear prescription form plugin for WordPress, where there are missing authorization checks on the RemoveItems AJAX action. Because of this, unauthenticated attackers can delete arbitrary WooCommerce product categories, including all their child categories, by manipulating the 'catIds' parameter.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can delete WooCommerce product categories without authentication, potentially disrupting your online store's product organization and causing loss of data related to product categories and their child categories.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring for unauthorized AJAX requests to the 'RemoveItems' action in the eyewear-prescription-form plugin. Specifically, look for HTTP POST requests to admin-ajax.php with the parameter 'action=RemoveItems' coming from unauthenticated sources. A sample command using curl to test this could be: curl -X POST 'https://yourwordpresssite.com/wp-admin/admin-ajax.php' -d 'action=RemoveItems&catIds=1'. Additionally, inspecting your web server logs or using network monitoring tools to filter for such AJAX calls without proper authentication can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Updating the eyewear-prescription-form plugin to a version later than 6.0.1 where the vulnerability is fixed. 2) If an update is not available, temporarily disabling or removing the plugin to prevent exploitation. 3) Restricting access to admin-ajax.php or specifically blocking unauthenticated AJAX requests related to the 'RemoveItems' action via web application firewall (WAF) or server rules. 4) Reviewing and tightening user capability checks and nonce verification in the plugin's AJAX handlers to ensure only authorized users can perform sensitive actions. [1]