PT-2026-2834 · WordPress · Perfit Woocommerce Plugin

Abhirup Konwar · CVE-2025-14173 · Publicado 2026-01-14 · Atualizado 2026-01-14

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Perfit WooCommerce plugin versions prior to 1.0.2

Description The Perfit WooCommerce plugin for WordPress is affected by a missing authorization issue. Specifically, the logout function, called through the actions function hooked to admin init, lacks proper authorization checks. This allows unauthenticated attackers to delete arbitrary plugin settings by manipulating the action parameter.

Recommendations Update the Perfit WooCommerce plugin to version 1.0.2 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14173

Produtos afetados

Perfit Woocommerce Plugin

Referências · 5

• https://plugins.trac.wordpress.org/browser/perfit-woocommerce/tags/1.0.1/includes/class-wcp-settings-tab.php#L102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14173 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011382970330829238 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/perfit-woocommerce/trunk/includes/class-wcp-settings-tab.php#L102 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/cb141b46-2585-4b58-8d91-0cdb275348a1?source=cve · Nota