CVE-2025-14365mediumCWE-862

CVE-2025-14365: medium-severity vulnerability in dugudlabs Eyewear prescription form

Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion

Published · Updated

Follow this CVE+ Monitor Eyewear prescription form

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce product categories, including all of their child categories, via the 'catIds' parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
dugudlabs · Eyewear prescription form
Related CVEs — dugudlabs Eyewear prescription form

In the same product, most dangerous first.

CVE-2024-54239CRITICALWordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.9%CVE-2025-14366MEDIUMEyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product CreationEPSS 0.3%