CVE-2025-14948 describes a missing authorization vulnerability in the miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress. Specifically, the AJAX action 'enable_wc_sms_notification' lacks a capability check, enabling unauthenticated attackers to modify SMS notification settings for WooCommerce orders. This issue affects all versions up to and including 4.3.8. The vulnerability is categorized under CWE-862 (Missing Authorization) and has a medium severity rating with a CVSS 3.1 score of 5.3. No patch or remediation details have been provided, and no known exploits have been reported.

An unauthenticated attacker can modify SMS notification settings for WooCommerce orders by exploiting the missing authorization check. This could lead to unauthorized enabling or disabling of SMS notifications, potentially disrupting order communication workflows. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX action if possible or monitor for suspicious activity related to SMS notification settings. Avoid relying on this plugin version in sensitive environments.