CVE-2025-6720 is a missing authorization vulnerability in the bandido MORKVA Vchasno Kasa Integration WordPress plugin. The clear_all_log() function lacks a capability check, enabling unauthenticated attackers to clear log files. This affects all versions up to 1.0.3. The CVSS 3.1 score is 5.3 (medium severity) with an attack vector of network, no privileges required, and no user interaction needed. The vulnerability impacts integrity by allowing unauthorized log deletion but does not affect confidentiality or availability. No patch or official fix is currently available, and no exploits have been observed in the wild.

An attacker can clear log files without authentication, potentially hindering forensic analysis or incident response by removing evidence of malicious activity. There is no direct impact on data confidentiality or system availability. The integrity of log data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity. Consider disabling or removing the plugin if logs are critical and no update is available.