CVE-2025-14070 is a missing authorization vulnerability (CWE-862) in the Reviewify WordPress plugin for WooCommerce. The issue arises from the lack of a capability check on the 'send_test_email' AJAX action, enabling authenticated users with Contributor or higher privileges to generate arbitrary discount coupons. This vulnerability affects all versions up to and including 1.0.7. The CVSS 3.1 base score is 7.5, indicating a high severity impact primarily due to integrity compromise without confidentiality or availability impact.

An attacker with Contributor-level access or above can exploit this vulnerability to create arbitrary WooCommerce discount coupons. This unauthorized coupon creation can cause financial loss to the affected e-commerce store by enabling discounts that were not intended or authorized by the store owner. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only, and monitor for suspicious coupon creation activities. Avoid granting unnecessary permissions to users and consider disabling or limiting the use of the 'send_test_email' AJAX action if possible.