CVE-2025-14342

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14342", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T14:21:18.363Z", "datePublished": "2026-02-19T04:36:16.373Z", "dateUpdated": "2026-04-08T17:02:24.892Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:24.892Z"}, "affected": [{"vendor": "cifi", "product": "SEO Plugin by Squirrly SEO", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.4.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from Squirrly's cloud service."}], "title": "SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad25948-3265-4c4c-9b99-86f7240600ce?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.14/controllers/SeoSettings.php#L616"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435711/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-11-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-17T16:58:27.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-18T16:09:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T20:39:50.519033Z", "id": "CVE-2025-14342", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T20:40:01.636Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T20:39:50.519033Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T20:39:56.284Z"}}], "cna": {"title": "SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "cifi", "product": "SEO Plugin by Squirrly SEO", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.4.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-17T16:58:27.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-18T16:09:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad25948-3265-4c4c-9b99-86f7240600ce?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.14/controllers/SeoSettings.php#L616"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435711/"}], "descriptions": [{"lang": "en", "value": "The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from Squirrly's cloud service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:24.892Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14342", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:24.892Z", "dateReserved": "2025-12-09T14:21:18.363Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:16.373Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SEO Plugin by Squirrly SEO", "vendor": "cifi", "versions": [{"lessThanOrEqual": "12.4.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from Squirrly's cloud service."}, {"lang": "es", "value": "El plugin SEO de Squirrly SEO plugin para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n sq_ajax_uninstall en todas las versiones hasta la 12.4.14, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, desconecten el sitio del servicio en la nube de Squirrly."}], "id": "CVE-2025-14342", "lastModified": "2026-06-17T08:35:46.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14342", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T20:39:50.519033Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:34.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/squirrly-seo/tags/12.4.14/controllers/SeoSettings.php#L616"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3435711/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad25948-3265-4c4c-9b99-86f7240600ce?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.4.14]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "SEO Plugin by Squirrly SEO", "source": "cna", "vendor": "cifi"}, "product": "seo_plugin_by_squirrly_seo", "vendor": "squirrly"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:53:54.903376+00:00", "value": {"mitigation_remediation": ["Update the SEO Plugin to any version newer than 12.4.14", "If an upgrade is not feasible, remove or disable the sq_ajax_uninstall handler in the plugin code", "Ensure that only administrator-level users can access plugin maintenance functions by adding an explicit capability check for subscriber-level users"], "summary": {"action": "Patch", "impact": "Unauthorized Disconnection of the Cloud Service by an Authenticated Subscriber or higher"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Squirrly SEO plugin, any installation running version 12.4.14 or earlier of the plugin.", "description_and_impact": "The SEO Plugin by Squirrly SEO has a missing capability check in the sq_ajax_uninstall function in all releases up to and including 12.4.14. This flaw allows any authenticated user with Subscriber-level access or higher to call the uninstall action that disconnects the WordPress site from Squirrly\u2019s cloud service. The consequence is loss of connectivity to the cloud service and the disabling of associated SEO features, but the attack does not expose data or enable remote code execution.", "risk_and_exploitability": "The CVSS score of 4.3 places this issue in the low severity range; the EPSS score is below 1\u202f%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an authenticated account with Subscriber or higher privileges and involves sending the sq_ajax_uninstall request to the plugin endpoint. Overall risk remains modest but addressing the issue is recommended to maintain cloud connectivity."}}}}, "created": "2026-02-19T10:07:07.837550+00:00", "updated": "2026-04-21T16:00:13.276372+00:00", "vendors": ["squirrly", "squirrly$PRODUCT$seo_plugin_by_squirrly_seo", "wordpress", "wordpress$PRODUCT$wordpress"]}