CVE-2025-14366

Name of the Vulnerable Software and Affected Versions Eyewear prescription form plugin for WordPress versions through 6.0.1

Description The Eyewear prescription form plugin for WordPress is susceptible to unauthorized access. This is caused by a lack of authorization checks on the SubmitCatProductRequest AJAX action. An attacker who is not authenticated can create arbitrary WooCommerce products, defining their names, prices, and category assignments through the 'Name', 'Price', and 'Parent' parameters. The affected API endpoint is SubmitCatProductRequest. The vulnerable parameters are Name, Price, and Parent.

Recommendations Update the Eyewear prescription form plugin to a version later than 6.0.1.