Eyewear Prescription Form CVE-2025-14365
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated AJAX call with no UI (AV:N/AC:L/PR:N/UI:N); unauthorized category deletion is an integrity impact (I:L), with no confidentiality and scope unchanged.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce product categories, including all of their child categories, via the 'catIds' parameter.
AnalysisAI
Missing authorization in the WordPress plugin Eyewear prescription form (all versions up to and including 6.0.1) lets unauthenticated remote attackers delete arbitrary WooCommerce product categories - including every child category beneath them - by invoking the plugin's RemoveItems AJAX action with attacker-controlled category IDs in the 'catIds' parameter. The CVSS vector (PR:N, UI:N) confirms exploitation requires no authentication and no user interaction, though impact is limited to integrity loss (I:L) on sites that both run WooCommerce and have the vulnerable plugin active. No public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the destructive-only, no-code-execution nature of the flaw.
Technical ContextAI
The affected component is a WordPress plugin that extends WooCommerce checkout/ordering workflows with prescription eyewear forms. WordPress exposes plugin AJAX handlers through wp-admin/admin-ajax.php, and handlers registered with the wp_ajax_nopriv_ prefix are reachable by completely unauthenticated visitors. According to the cited plugin source (admin/class-eyewear_prescription_form-admin.php, lines 74 and 326 in tag 6.0.1), the RemoveItems action is registered and then executed without any capability check - no current_user_can('manage_woocommerce'), current_user_can('manage_categories'), nonce verification, or equivalent gate. This is a textbook CWE-862 Missing Authorization defect: the code trusts the request to come from an authorized administrator and acts on user-supplied 'catIds' directly. Because the handler ultimately calls WooCommerce/product_cat term-deletion logic, an anonymous request can remove any product category term, and term deletion cascades to child terms, so a single request can wipe out an entire category subtree. The attack is purely destructive - no code execution, privilege escalation, or data disclosure is involved - but category taxonomy underpins storefront navigation, menus, and URL structure, so deletion can break storefront browsing and SEO until restored. A CPE string was not supplied in the source data; the only product identifier available is the WordPress plugin slug 'eyewear-prescription-form'.
Affected ProductsAI
The WordPress plugin Eyewear prescription form, version 6.0.1 and every earlier release, is affected; the plugin slug is eyewear-prescription-form and the vulnerable file is admin/class-eyewear_prescription_form-admin.php as published in tag 6.0.1 (see https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L326 and #L74). The plugin must be installed and active, and WooCommerce must be present with at least one product category term in existence for exploitation to have any effect - sites running the plugin without WooCommerce, or with an empty category taxonomy, are not meaningfully exposed. The only authoritative public advisory reference is the Wordfence threat-intel entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/b85fc103-20e5-4599-8ed5-5bd5d9c447ee?source=cve. No CPE data was provided to further narrow the affected population.
RemediationAI
No vendor-released patch was identified at time of analysis, and the reported version ceiling (6.0.1) means administrators cannot simply upgrade to a known-fixed release - check the plugin's WordPress.org page and changelog for a version above 6.0.1 before assuming one exists. Until a fix ships, the most direct mitigation is to deactivate the Eyewear prescription form plugin entirely; the trade-off is loss of its prescription-form functionality on the storefront. If the plugin must stay active, restrict the RemoveItems AJAX action: add a small mu-plugin that hooks the same action name ahead of the vulnerable callback, verifies a valid nonce or current_user_can('manage_woocommerce'), and returns 403 for anonymous callers - the trade-off is that any legitimate admin-side bulk category deletion from the plugin UI may need a matching nonce. A WAF or reverse-proxy rule blocking POST/GET requests to /wp-admin/admin-ajax.php where the action parameter matches the plugin's RemoveItems action will stop the abuse with minimal side effects, whereas blanket blocking of admin-ajax.php will break AJAX functionality for many other plugins and should be avoided. As a compensating detection and recovery measure, monitor for unexpected term deletions in the product_cat taxonomy and maintain recent database backups so deleted categories and their children can be restored promptly. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b85fc103-20e5-4599-8ed5-5bd5d9c447ee?source=cve) for updates on patched versions.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today