CVE-2025-1780

Name of the Vulnerable Software and Affected Versions The BuddyPress WooCommerce My Account Integration plugin versions up to, and including, 3.4.25

Description The issue is related to a missing capability check on the wc4bp delete page() function, allowing authenticated attackers with Subscriber-level access and above to update the plugin's page setting.

Recommendations For versions up to, and including, 3.4.25, consider disabling the wc4bp delete page() function until a patch is available to prevent unauthorized access.