CVE-2025-1780 is a missing authorization vulnerability (CWE-862) in the BuddyPress WooCommerce My Account Integration plugin for WordPress. The issue arises because the wc4bp_delete_page() function lacks a capability check, enabling authenticated users with low-level privileges (Subscriber and above) to modify plugin page settings. This vulnerability affects all versions up to and including 3.4.25. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Authenticated users with Subscriber-level access or higher can update the plugin's page settings without proper authorization. This could lead to unauthorized modification of WooCommerce member pages, potentially affecting site integrity or user experience. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users.