PT-2026-2834 · WordPress · Perfit Woocommerce Plugin

Abhirup Konwar · Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-14173

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Perfit WooCommerce plugin versions prior to 1.0.2

Description The Perfit WooCommerce plugin for WordPress is affected by a missing authorization issue. Specifically, the logout function, called through the actions function hooked to admin init, lacks proper authorization checks. This allows unauthenticated attackers to delete arbitrary plugin settings by manipulating the action parameter.

Recommendations Update the Perfit WooCommerce plugin to version 1.0.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14173

Affected Products

Perfit Woocommerce Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14173 · Security Note
• https://plugins.trac.wordpress.org/browser/perfit-woocommerce/tags/1.0.1/includes/class-wcp-settings-tab.php#L102 · Note
• https://twitter.com/CVEnew/status/2011382970330829238 · Twitter Post
• https://plugins.trac.wordpress.org/browser/perfit-woocommerce/trunk/includes/class-wcp-settings-tab.php#L102 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cb141b46-2585-4b58-8d91-0cdb275348a1?source=cve · Note