CVE-2025-14357
Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Data Modification in Mega Store WooCommerce Theme

Publication date: 2026-02-19

Last updated on: 2026-02-19

Assigner: Wordfence

Description
The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setup_widgets() function in core/includes/importer/whizzie.php in all versions up to, and including, 5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary pages and modify site settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-19
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-05
NVD
CVE-2025-14357
EUVD
EUVD-2025-207919

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misbahwp mega_store_woocommerce to 5.9 (inc)
woocommerce mega_store to 5.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mega Store Woocommerce theme for WordPress has a vulnerability due to a missing capability check in the setup_widgets() function located in core/includes/importer/whizzie.php. This flaw exists in all versions up to and including version 5.9.

Because of this missing check, authenticated users with Subscriber-level access or higher can exploit the vulnerability to create arbitrary pages and modify site settings without proper authorization.

Impact Analysis

This vulnerability allows attackers with low-level authenticated access (Subscriber-level and above) to modify site content and settings arbitrarily.

  • Creation of unauthorized pages on the website.
  • Modification of site settings without proper permissions.

Such unauthorized changes can lead to defacement, misinformation, or disruption of normal site operations.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart