CVE-2025-14080

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14080", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T22:54:29.575Z", "datePublished": "2025-12-21T02:20:30.792Z", "dateUpdated": "2026-04-08T16:47:57.152Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:57.152Z"}, "affected": [{"vendor": "wpshuffle", "product": "Frontend Post Submission Manager Lite \u2013 Frontend Posting WordPress Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors."}], "title": "Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/cores/ajax-process-form.php#L104"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.5/includes/cores/ajax-process-form.php#L104"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3419835%40frontend-post-submission-manager-lite&new=3419835%40frontend-post-submission-manager-lite&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-12-07T08:27:40.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-20T14:15:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T15:54:02.886115Z", "id": "CVE-2025-14080", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T15:54:16.160Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14080", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T15:54:02.886115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T15:54:08.063Z"}}], "cna": {"title": "Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wpshuffle", "product": "Frontend Post Submission Manager Lite \u2013 Frontend Posting WordPress Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-07T08:27:40.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-20T14:15:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/cores/ajax-process-form.php#L104"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.5/includes/cores/ajax-process-form.php#L104"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3419835%40frontend-post-submission-manager-lite&new=3419835%40frontend-post-submission-manager-lite&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:57.152Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14080", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:57.152Z", "dateReserved": "2025-12-04T22:54:29.575Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-21T02:20:30.792Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Frontend Post Submission Manager Lite \u2013 Frontend Posting WordPress Plugin", "vendor": "wpshuffle", "versions": [{"lessThanOrEqual": "1.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors."}, {"lang": "es", "value": "El plugin Frontend Post Submission Manager Lite para WordPress es vulnerable a falta de autorizaci\u00f3n en todas las versiones hasta la versi\u00f3n 1.2.5 incluida. Esto se debe a la ausencia de comprobaciones de autorizaci\u00f3n en la funcionalidad de actualizaci\u00f3n de publicaciones en la acci\u00f3n AJAX?fpsml_form_process. Esto permite que atacantes no autenticados modifiquen publicaciones arbitrarias proporcionando un par\u00e1metro?post_id a trav\u00e9s del formulario de publicaci\u00f3n de invitados, lo que les permite cambiar los t\u00edtulos de las publicaciones, el contenido, los extractos y eliminar a los autores de las publicaciones."}], "id": "CVE-2025-14080", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14080", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-22T15:54:02.886115Z", "version": "2.0.3"}}]}, "published": "2025-12-21T03:15:52.660", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.5/includes/cores/ajax-process-form.php#L104"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/cores/ajax-process-form.php#L104"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3419835%40frontend-post-submission-manager-lite&new=3419835%40frontend-post-submission-manager-lite&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:58:20.445745+00:00", "value": {"mitigation_remediation": ["Upgrade the Frontend Post Submission Manager Lite plugin to version 1.2.6 or later, which removes the missing authorization check in the ajax handler.", "If an immediate upgrade is not possible, restrict access to the guest posting form so that only authenticated users can submit or modify posts, or disable the form entirely for unauthenticated visitors.", "Monitor the site\u2019s audit logs for unexpected post updates from unknown IP addresses to detect potential abuse of the unfixed flaw."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Post Modification"}, "threat_synthesis": {"affected_systems": "All installations of the WordPress Frontend Post Submission Manager Lite plugin up to and including version 1.2.5 are affected. The issue exists in the ajax-process-form.php file that handles the fpsml_form_process action for all users, including guests.", "description_and_impact": "The Frontend Post Submission Manager Lite plugin allows an unauthenticated user to modify existing WordPress posts by sending a post_id parameter through the guest posting form, bypassing any authorization checks. This flaw enables the attacker to change titles, content, excerpts, and remove the post author, thereby compromising the integrity of site content. The vulnerability is categorized under CWE\u2011862 and presents a functional violation of access control rather than a code execution risk.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate risk, but the EPSS score of less than 1% suggests that exploitation is presently uncommon. The flaw is not listed in CISA's KEV catalog. The attack vector appears to be the publicly accessible AJAX endpoint, requiring no authentication but allowing arbitrary post modification when a valid post ID is supplied. The overall risk is moderate with low exploitation probability, yet the integrity of content is directly impacted."}}}}, "created": "2025-12-23T22:52:26.893774+00:00", "updated": "2026-04-21T17:00:12.333342+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpshuffle", "wpshuffle$PRODUCT$frontend_post_submission_manager"]}