CVE-2025-14447: CWE-862 Missing Authorization in pcantoni AnnunciFunebri
The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
AI Analysis
Technical Summary
CVE-2025-14447 is a missing authorization vulnerability (CWE-862) in the AnnunciFunebri Impresa WordPress plugin by pcantoni. The annfu_reset_options() function lacks proper capability checks, enabling any authenticated user with at least Subscriber privileges to invoke this function and delete all plugin options, effectively resetting the plugin configuration. This affects all versions up to and including 4.7.0. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity of plugin settings.
Potential Impact
An attacker with Subscriber-level access or higher can reset the plugin's configuration by deleting all stored options. This results in loss of customized plugin settings, which may disrupt normal plugin operation or require reconfiguration. There is no direct impact on confidentiality or availability reported. No known exploits are currently in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict Subscriber-level access to trusted users only to reduce risk. No cloud service remediation applies as this is a self-hosted WordPress plugin.
CVE-2025-14447: CWE-862 Missing Authorization in pcantoni AnnunciFunebri
Description
The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-14447 is a missing authorization vulnerability (CWE-862) in the AnnunciFunebri Impresa WordPress plugin by pcantoni. The annfu_reset_options() function lacks proper capability checks, enabling any authenticated user with at least Subscriber privileges to invoke this function and delete all plugin options, effectively resetting the plugin configuration. This affects all versions up to and including 4.7.0. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity of plugin settings.
Potential Impact
An attacker with Subscriber-level access or higher can reset the plugin's configuration by deleting all stored options. This results in loss of customized plugin settings, which may disrupt normal plugin operation or require reconfiguration. There is no direct impact on confidentiality or availability reported. No known exploits are currently in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict Subscriber-level access to trusted users only to reduce risk. No cloud service remediation applies as this is a self-hosted WordPress plugin.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-10T13:54:13.521Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 693cef65d977419e584a5094
Added to database: 12/13/2025, 4:45:25 AM
Last enriched: 4/9/2026, 9:16:04 PM
Last updated: 5/10/2026, 8:14:31 AM
Views: 124
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.