CVE-2025-14070

Description

The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to create arbitrary WooCommerce discount coupons, potentially causing financial loss to the store.

PUBLISHED Reserved 2025-12-04 | Published 2026-01-07 | Updated 2026-01-07 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Itthidej Aramsri finder

References

www.wordfence.com/...-a177-4d39-b169-dc874cac2b3b?source=cve

cwe.mitre.org/data/definitions/862.html

plugins.trac.wordpress.org/...crd-review-discounts-admin.php

plugins.trac.wordpress.org/...crd-review-discounts-admin.php

cve.org (CVE-2025-14070)

nvd.nist.gov (CVE-2025-14070)

Download JSON