CVE-2025-14366
📋 TL;DR
This vulnerability allows unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and categories on WordPress sites using the Eyewear prescription form plugin. All WordPress sites with this plugin installed up to version 6.0.1 are affected. Attackers can manipulate product listings without any authentication.
💻 Affected Systems
- WordPress Eyewear prescription form plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers flood the site with fake products, causing inventory management chaos, financial loss from incorrect pricing, SEO damage from malicious content, and potential data corruption requiring full site restoration.
Likely Case
Attackers create spam products with inappropriate names/prices, disrupting legitimate business operations and requiring manual cleanup of WooCommerce database entries.
If Mitigated
With proper monitoring, unauthorized product creation is quickly detected and reverted before causing significant business impact.
🎯 Exploit Status
Exploitation requires only HTTP POST requests to the vulnerable AJAX endpoint with basic parameters. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.2 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Eyewear prescription form' plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 6.0.2+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
allRemove or restrict access to the SubmitCatProductRequest AJAX action
Add to theme's functions.php or custom plugin: remove_action('wp_ajax_SubmitCatProductRequest', 'eyewear_prescription_form_SubmitCatProductRequest'); remove_action('wp_ajax_nopriv_SubmitCatProductRequest', 'eyewear_prescription_form_SubmitCatProductRequest');
Temporarily disable plugin
linuxDeactivate the vulnerable plugin until patched
wp plugin deactivate eyewear-prescription-form
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block requests to wp-admin/admin-ajax.php with 'action=SubmitCatProductRequest' parameter
- Add authentication middleware to verify user capabilities before processing WooCommerce product creation requests
🔍 How to Verify
Check if Vulnerable:
Check if plugin version is 6.0.1 or lower in WordPress admin → Plugins, or run: wp plugin get eyewear-prescription-form --field=versionCheck Version:
wp plugin get eyewear-prescription-form --field=versionVerify Fix Applied:
Confirm plugin version is 6.0.2 or higher, and test that unauthenticated POST requests to /wp-admin/admin-ajax.php with action=SubmitCatProductRequest return proper authorization errors📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-admin/admin-ajax.php with 'action=SubmitCatProductRequest' from unauthenticated users
- Unexpected WooCommerce product creation events in WooCommerce logs
- Spike in database insert operations on wp_posts and wp_postmeta tables
Network Indicators:
- HTTP POST requests containing parameters: Name, Price, Parent sent to WordPress AJAX endpoint without authentication cookies
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "SubmitCatProductRequest" AND NOT (user_id>0 OR authenticated_user=true)🔗 References
- https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L369
- https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L71
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0f21d7a2-3b4f-487f-a64a-b963427233b3?source=cve
