The Sweet Energy Efficiency plugin for WordPress suffers from a missing capability check on the 'sweet_energy_efficiency_action' AJAX handler in all versions up to and including 1.0.6. This lack of authorization verification enables authenticated attackers with subscriber-level privileges or higher to perform unauthorized read, modification, and deletion operations on arbitrary graphs managed by the plugin. The vulnerability is tracked as CVE-2025-14618 and categorized under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, impacting integrity but not confidentiality or availability.

Authenticated users with subscriber-level access or higher can exploit this vulnerability to read, modify, and delete arbitrary graph data within the plugin. This compromises data integrity but does not affect confidentiality or availability. There are no known active exploits in the wild. The impact is limited to users who already have some level of authenticated access to the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for unusual activity related to the Sweet Energy Efficiency plugin. Avoid granting unnecessary privileges to low-level authenticated users. No official patch or temporary fix has been published as of now.