CVE-2025-14447

AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion

View on CVE.org
Published Dec 13, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.

Analysis

AI-generated

Technical impact

A missing capability check in the annfu_reset_options() function of the AnnunciFunebri Impresa WordPress plugin allows an authenticated user with Subscriber or higher privileges to delete all 29 plugin options, resetting the plugin to its default state. This loss of configuration can disrupt funeral announcement services and affect the integrity of site data.

Affected Systems

The vulnerability is present in all releases of the AnnunciFunebri plugin up to and including version 4.7.0. WordPress sites that install any of these versions and grant Subscriber or greater roles to users are affected.

Risk and Exploitability

The CVSS score is 4.3 and the EPSS score is below 1%, indicating a low to moderate severity and a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because exploitation requires a valid WordPress account with Subscriber or higher privileges, the threat primarily comes from compromised or malicious internal accounts rather than external attackers.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the AnnunciFunebri plugin to a version that includes the missing capability check.
  • If an update is not immediately possible, remove or restrict the annfu_reset_options capability from the Subscriber role, or disable the plugin until a fix is available.
  • As a temporary workaround, manually recreate the plugin options and limit access to the reset functionality by adjusting user role permissions.

Generated by OpenCVE AI on April 22, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
Title AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:43 PM
Reserved
Dec 10, 2025, 1:54 PM

View source JSON

Updated
Dec 15, 2025, 3:25 PM

JSON

Status
Deferred
Published
Dec 13, 2025, 4:16 PM
Modified
Oct 7, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 22, 2026, 4:15 PM

JSON