AnnunciFunebri Impresa, CVE-2025-14447

CVE, Research URL: CVE-2025-14447
Home page URL: Security reports for AnnunciFunebri Impresa
Application: AnnunciFunebri Impresa
Published on: Dec 13, 2025
Research Description: The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
Affected versions: max 4.7.0.
Status: vulnerable