Eyewear Prescription Form CVE-2025-14366
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote AJAX action with no nonce check gives AV:N/AC:L/PR:N/UI:N; impact is limited to creating products, so I:L and C:N/A:N.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
AnalysisAI
Unauthenticated attackers can create arbitrary WooCommerce products on WordPress sites running the Eyewear Prescription Form plugin up to and including version 6.0.1, because the SubmitCatProductRequest AJAX action lacks any authorization or nonce checks. The flaw is rated CVSS 5.3 with an EPSS score of 0.27% (18th percentile); no public exploit has been identified at time of analysis, and exploitation requires WooCommerce to be installed alongside the plugin. Impact is limited to integrity (product creation) with no confidentiality or availability effect.
Technical ContextAI
The Eyewear Prescription Form plugin registers a WordPress AJAX action named SubmitCatProductRequest, reachable via admin-ajax.php. Per CWE-862 (Missing Authorization), the handler in admin/class-eyewear_prescription_form-admin.php (see Trac lines 71 and 369 for tag 6.0.1) performs no capability check such as current_user_can and no nonce verification before processing the request. Because the action is exposed to unauthenticated users (the plugin registers wp_ajax_nopriv_SubmitCatProductRequest), any remote attacker can supply the Name, Price, and Parent parameters to create WooCommerce products with attacker-controlled names, prices, and category assignments. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms a remotely exploitable, unauthenticated condition with low integrity impact and no confidentiality or availability effect. The code path operates within the WordPress and WooCommerce ecosystem, so WooCommerce must be present for the action to succeed.
Affected ProductsAI
Eyewear Prescription Form plugin for WordPress, all versions up to and including 6.0.1, are affected. The vulnerable code resides in the admin class file admin/class-eyewear_prescription_form-admin.php as tagged in the WordPress plugin repository. Exploitation additionally requires that WooCommerce is installed and active on the target site, since the SubmitCatProductRequest action creates WooCommerce products. No CPE string was provided in the input data; the vendor plugin page and the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0f21d7a2-3b4f-487f-a64a-b963427233b3?source=cve) provide further product details.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis; the latest tagged version observed is 6.0.1, which is vulnerable. Until a fixed release is published, consider deactivating and removing the Eyewear Prescription Form plugin if it is not essential, which eliminates the vulnerable AJAX action entirely. If the plugin must remain, deploy a web application firewall rule or server-level filter to block requests containing the parameter action=SubmitCatProductRequest, especially unauthenticated POST requests to /wp-admin/admin-ajax.php; trade-off is potential breakage of the plugin legitimate front-end functionality. Also restrict or monitor WooCommerce product creation, audit existing product listings for unexpected entries that may be used for spam, SEO manipulation, or malicious redirects, and remove any unauthorized products. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0f21d7a2-3b4f-487f-a64a-b963427233b3?source=cve) and the WordPress plugin Trac for a patched version. Blocking all unauthenticated access to admin-ajax.php is not recommended because it will break many WordPress features.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today