CVE-2025-0954 identifies a missing authorization vulnerability in the WP Online Contract plugin by futuredesigngrp for WordPress. Specifically, the json_import() and json_export() functions lack capability checks, enabling unauthenticated users to import and export plugin settings. This vulnerability affects all versions up to and including 5.1.4. The CVSS 3.1 score is 6.5 (medium severity) with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity partially. No patch or remediation details have been disclosed.

An attacker can access and modify the plugin's configuration by importing or exporting settings without authentication. This could lead to unauthorized changes in contract management configurations, potentially impacting confidentiality and integrity of the plugin's data. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress installation and consider disabling or removing the WP Online Contract plugin if not essential. Monitor vendor channels for updates and apply patches promptly once available.