CVE-2025-13529 is a missing authorization vulnerability in the codeclouds Unify WordPress plugin. The issue arises from a lack of capability checks on the 'init' action, permitting unauthenticated users to delete certain plugin options via the 'unify_plugin_downgrade' parameter. This vulnerability affects all versions up to and including 3.4.9. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity loss (unauthorized modification of plugin data) without confidentiality or availability impact. No patch or official fix has been documented.

An unauthenticated attacker can delete specific plugin options in the Unify WordPress plugin, causing unauthorized modification of plugin data. This may affect the plugin's configuration or behavior but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin functionality or disabling the plugin if feasible. Monitor official codeclouds or WordPress security channels for updates.