CVE-2025-14367 is a missing authorization vulnerability in the Easy Theme Options plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises from the eto_import_settings function lacking proper authorization checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to import arbitrary plugin settings. This could lead to unauthorized modification of plugin configurations. The CVSS 3.1 score is 5.3 (medium severity), reflecting limited impact on confidentiality and availability but some integrity impact. No patch or official fix has been documented, and no exploits are known in the wild.

An attacker with Subscriber-level access or higher can exploit this vulnerability to import arbitrary plugin settings, potentially altering the plugin's configuration without proper authorization. This impacts the integrity of the plugin settings but does not affect confidentiality or availability according to the CVSS vector. There is no evidence of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor plugin settings for unauthorized changes. Avoid granting unnecessary privileges to low-level authenticated users.