CVE-2025-14357 describes a missing authorization vulnerability in the Mega Store Woocommerce theme for WordPress. Specifically, the setup_widgets() function in core/includes/importer/whizzie.php lacks proper capability checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized modifications such as creating arbitrary pages and changing site settings. This vulnerability affects all versions up to 5.9. The CVSS 3.1 base score is 5.3, indicating a medium severity level. No known exploits are reported in the wild, and no patch or official fix has been documented.

An attacker with Subscriber-level access or higher can exploit this vulnerability to create arbitrary pages and modify site settings without proper authorization. This could lead to unauthorized content injection or configuration changes within the affected WordPress site. There is no indication of confidentiality or availability impact, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unauthorized changes. Avoid granting unnecessary privileges to low-level authenticated users.