What is the CVSS score of CVE-2025-14447?

CVE-2025-14447 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14447

MEDIUM

Missing Authorization (CWE-862)

2025-12-13 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 13, 2025 - 16:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.

AnalysisAI

Unauthorized data modification in AnnunciFunebri Impresa WordPress plugin through version 4.7.0 allows authenticated subscribers to reset all plugin options via the missing capability check on annfu_reset_options() function. Attackers with Subscriber-level access can delete all 29 plugin configuration options, reverting the plugin to default state without administrative authorization. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from a missing capability check (CWE-862: Missing Authorization) in the annfu_reset_options() function within the AnnunciFunebri Impresa WordPress plugin. WordPress uses a role-based access control system where administrative functions should be protected by capability checks using functions like current_user_can(). The vulnerable function fails to validate that the calling user possesses the required administrative capabilities before executing the option reset operation. This allows any authenticated user, including those with the lowest privilege level (Subscriber), to invoke the function and completely reset 29 plugin options. The vulnerability is present in the plugin codebase across all versions up to and including 4.7.0, affecting WordPress installations where this plugin is active and where subscriber accounts exist.

Affected ProductsAI

The AnnunciFunebri Impresa plugin for WordPress is affected in all versions up to and including 4.7.0. The plugin is identified through the official WordPress plugin repository at plugins.trac.wordpress.org/browser/annuncifunebri-onoranza. Any WordPress installation running this plugin at version 4.7.0 or earlier with subscriber accounts active is at risk. The vulnerability was reported by Wordfence security research team.

RemediationAI

Update the AnnunciFunebri Impresa plugin to a patched version released after 4.7.0 that implements capability checks on the annfu_reset_options() function. Site administrators should immediately upgrade through the WordPress plugin dashboard or manually download the latest version from the official plugin repository. If an immediate patch is unavailable, restrict subscriber account creation or limit subscriber access permissions through role management plugins until the update is deployed. Verify the patch has been applied by reviewing the functions.inc.php file at line 845 to confirm the presence of appropriate current_user_can() capability checks. Consult the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9ea2a2-34af-408c-91ee-6d5fd9431529 for ongoing patching guidance.