CVE-2025-14366mediumCWE-862

CVE-2025-14366: fallo de gravedad media en dugudlabs Eyewear prescription form

Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Eyewear prescription form

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
dugudlabs · Eyewear prescription form
CVEs relacionadas — dugudlabs Eyewear prescription form

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-54239CRITICALWordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.9%CVE-2025-14365MEDIUMEyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category DeletionEPSS 0.3%