CVE-2025-14389

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14389", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T20:39:24.005Z", "datePublished": "2026-01-14T05:28:04.313Z", "dateUpdated": "2026-04-08T16:36:45.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:45.826Z"}, "affected": [{"vendor": "obridgeacademy", "product": "WPBlogSyn", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's remote sync settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/141137a4-609f-4ea9-beba-d37b48144c29?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblogsync/tags/1.0/blogsync.php#L14"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2026-01-13T17:16:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T15:45:10.509153Z", "id": "CVE-2025-14389", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:17:20.698Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T15:45:10.509153Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T15:45:13.031Z"}}], "cna": {"title": "WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "obridgeacademy", "product": "WPBlogSyn", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-13T17:16:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/141137a4-609f-4ea9-beba-d37b48144c29?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblogsync/tags/1.0/blogsync.php#L14"}], "descriptions": [{"lang": "en", "value": "The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's remote sync settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-14T05:28:04.313Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14389", "state": "PUBLISHED", "dateUpdated": "2026-01-14T19:17:20.698Z", "dateReserved": "2025-12-09T20:39:24.005Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T05:28:04.313Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPBlogSyn", "vendor": "obridgeacademy", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's remote sync settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin WPBlogSyn para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en versiones hasta la 1.0, inclusive. Esto se debe a una validaci\u00f3n de nonce ausente o incorrecta. Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n de sincronizaci\u00f3n remota del plugin a trav\u00e9s de una petici\u00f3n falsificada siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14389", "lastModified": "2026-06-17T08:35:51.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14389", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T15:45:10.509153Z", "version": "2.0.3"}}]}, "published": "2026-01-14T06:15:52.290", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpblogsync/tags/1.0/blogsync.php#L14"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/141137a4-609f-4ea9-beba-d37b48144c29?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:10:44.555528+00:00", "value": {"mitigation_remediation": ["Update the WPBlogSyn plugin to a version that includes proper nonce validation or, if no fix is available, uninstall or disable the plugin.", "Review and secure the remote sync configuration: verify the designated remote endpoints, remove any unintended or deprecated sync targets, and disable remote sync functionality until the plugin is patched.", "Educate site administrators about CSRF risks and implement a phishing\u2011awareness program; optionally add an extra confirmation step before allowing sync configuration changes."], "summary": {"action": "Patch immediately", "impact": "Unauthorized configuration change"}, "threat_synthesis": {"affected_systems": "All installations of the WPBlogSyn WordPress plugin from vendor Obridge Academy with version 1.0 or earlier are affected.", "description_and_impact": "The WPBlogSyn plugin contains a Cross\u2011Site Request Forgery flaw that allows any unauthenticated user to alter the plugin\u2019s remote sync settings. Missing or incorrect nonce validation means a crafted request can be accepted without the proper security token. If exploited, an attacker can modify where the plugin pushes or pulls content, potentially enabling unauthorized data transfer or disrupting site operations.", "risk_and_exploitability": "The CVSS score of 4.3 categorizes this vulnerability as moderate severity. The EPSS indicates a very low exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a phishing or social engineering trick that causes an administrator to click a malicious link, thereby submitting a forged request that updates the remote sync configuration. Because the exploit requires the site administrator to perform an action, the risk is mitigated by security awareness and user training."}}}}, "created": "2026-01-14T10:48:42.708872+00:00", "updated": "2026-04-22T20:15:20.534120+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}