CVE-2025-6721 describes a missing authorization vulnerability in the Vchasno Kasa WordPress plugin (MORKVA Vchasno Kasa Integration). The mrkv_vchasno_kasa_wc_do_metabox_action() function lacks proper capability checks, enabling unauthenticated users to generate invoices for arbitrary orders. This vulnerability affects all plugin versions up to 1.0.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability.

An unauthenticated attacker can exploit this vulnerability to generate invoices for arbitrary orders without proper authorization. This could lead to unauthorized access to some order-related data, potentially exposing sensitive information. However, the vulnerability does not allow modification or deletion of data, nor does it affect system availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix has been provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected functionality or disabling the plugin if feasible to prevent exploitation.