Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-14367: Easy Theme Options plugin for WordPress allows unauthorized settings access
CVE-2025-14367 · published 10 months ago
Summary
The Easy Theme Options plugin for WordPress is not secure in versions 1.0 and earlier. This means that users with a low-level account can access and change settings that they shouldn't be able to. Update to a newer version to fix this issue.
Original advisory text
The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorization checks in the eto_import_settings ...
The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorization checks in the eto_import_settings function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import arbitrary plugin settings via the 'eto_import_settings' parameter.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published13 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-14367 · NVD
Track software like this
Free during beta