CVE-2025-14447
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
Analysis
Unauthorized data modification in AnnunciFunebri Impresa WordPress plugin through version 4.7.0 allows authenticated subscribers to reset all plugin options via the missing capability check on annfu_reset_options() function. Attackers with Subscriber-level access can delete all 29 plugin configuration options, reverting the plugin to default state without administrative authorization. No public exploit code or active exploitation has been identified at time of analysis.
Technical Context
The vulnerability stems from a missing capability check (CWE-862: Missing Authorization) in the annfu_reset_options() function within the AnnunciFunebri Impresa WordPress plugin. WordPress uses a role-based access control system where administrative functions should be protected by capability checks using functions like current_user_can(). The vulnerable function fails to validate that the calling user possesses the required administrative capabilities before executing the option reset operation. This allows any authenticated user, including those with the lowest privilege level (Subscriber), to invoke the function and completely reset 29 plugin options. The vulnerability is present in the plugin codebase across all versions up to and including 4.7.0, affecting WordPress installations where this plugin is active and where subscriber accounts exist.
Affected Products
The AnnunciFunebri Impresa plugin for WordPress is affected in all versions up to and including 4.7.0. The plugin is identified through the official WordPress plugin repository at plugins.trac.wordpress.org/browser/annuncifunebri-onoranza. Any WordPress installation running this plugin at version 4.7.0 or earlier with subscriber accounts active is at risk. The vulnerability was reported by Wordfence security research team.
Remediation
Update the AnnunciFunebri Impresa plugin to a patched version released after 4.7.0 that implements capability checks on the annfu_reset_options() function. Site administrators should immediately upgrade through the WordPress plugin dashboard or manually download the latest version from the official plugin repository. If an immediate patch is unavailable, restrict subscriber account creation or limit subscriber access permissions through role management plugins until the update is deployed. Verify the patch has been applied by reviewing the functions.inc.php file at line 845 to confirm the presence of appropriate current_user_can() capability checks. Consult the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9ea2a2-34af-408c-91ee-6d5fd9431529 for ongoing patching guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today