CVE-2025-14173 describes a missing authorization vulnerability in the Perfit WooCommerce WordPress plugin (versions up to 1.0.1). The issue arises because the logout function, which is called via the actions function hooked to admin_init, lacks proper authorization checks. This enables unauthenticated attackers to delete arbitrary plugin settings by manipulating the action parameter. The vulnerability is identified as CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation information is currently available.

An unauthenticated attacker can delete arbitrary settings of the Perfit WooCommerce plugin, potentially disrupting plugin functionality or causing denial of service conditions related to plugin configuration. There is no confidentiality or availability impact reported, and no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the WordPress admin_init hook or monitor for suspicious requests targeting the action parameter related to the Perfit WooCommerce plugin. Avoid exposing the plugin to untrusted users where possible.