CVE-2025-14468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14468", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T16:39:16.138Z", "datePublished": "2026-01-07T04:32:04.424Z", "dateUpdated": "2026-04-08T16:35:14.456Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:14.456Z"}, "affected": [{"vendor": "mohammed_kaludi", "product": "AMP for WP \u2013 Accelerated Mobile Pages", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled."}], "title": "AMP for WP \u2013 Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d195034-4617-474d-a4b1-b299c1607f89?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L119"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L698"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3426181%40accelerated-mobile-pages%2Ftrunk&old=3402644%40accelerated-mobile-pages%2Ftrunk&sfp_email=&sfph_mail=#file4"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafa\u0142"}], "timeline": [{"time": "2026-01-06T16:00:31.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:53:07.499020Z", "id": "CVE-2025-14468", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:46.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:53:07.499020Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:53:09.991Z"}}], "cna": {"title": "AMP for WP \u2013 Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission", "credits": [{"lang": "en", "type": "finder", "value": "Rafa\u0142"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mohammed_kaludi", "product": "AMP for WP \u2013 Accelerated Mobile Pages", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T16:00:31.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d195034-4617-474d-a4b1-b299c1607f89?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L119"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L698"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3426181%40accelerated-mobile-pages%2Ftrunk&old=3402644%40accelerated-mobile-pages%2Ftrunk&sfp_email=&sfph_mail=#file4"}], "descriptions": [{"lang": "en", "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:14.456Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14468", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:14.456Z", "dateReserved": "2025-12-10T16:39:16.138Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T04:32:04.424Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AMP for WP \u2013 Accelerated Mobile Pages", "vendor": "mohammed_kaludi", "versions": [{"lessThanOrEqual": "1.1.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled."}, {"lang": "es", "value": "El plugin AMP for WP \u2013 Accelerated Mobile Pages para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en versiones hasta la 1.1.9, inclusive. Esto se debe a una l\u00f3gica de verificaci\u00f3n de nonce invertida en el manejador AJAX amp_theme_ajaxcomments, que rechaza las peticiones con nonces V\u00c1LIDOS y acepta las peticiones con nonces FALTANTES o INV\u00c1LIDOS. Esto permite a atacantes no autenticados enviar comentarios en nombre de usuarios con sesi\u00f3n iniciada a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace, y el modo de plantilla del plugin est\u00e9 habilitado."}], "id": "CVE-2025-14468", "lastModified": "2026-06-17T08:35:59.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14468", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:53:07.499020Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:55.210", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L119"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L50"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L698"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3426181%40accelerated-mobile-pages%2Ftrunk&old=3402644%40accelerated-mobile-pages%2Ftrunk&sfp_email=&sfph_mail=#file4"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d195034-4617-474d-a4b1-b299c1607f89?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:56:25.821651+00:00", "value": {"mitigation_remediation": ["Update the AMP for WP plugin to the latest version that removes the inverted nonce validation logic.", "If an immediate update is not possible and the site must remain operational, disable the template mode feature via the plugin settings or remove the template-mode.php file to eliminate the vulnerable AJAX handler.", "Apply a site\u2011wide anti\u2011CSRF measure, such as a trusted\u2011origin check or the WordPress built\u2011in wp_nonce_field when handling AJAX requests, to mitigate the risk of future similar flaws."], "summary": {"action": "Patch Update", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "WordPress sites running the AMP for WP \u2013 Accelerated Mobile Pages plugin, versions 1.1.9 or earlier, with template mode enabled. The issue was discovered in the PHP file amp_theme_ajaxcomments and requires the plugin to be updated to a version newer than 1.1.9 to remove the inverted nonce logic.", "description_and_impact": "The AMP for WP \u2013 Accelerated Mobile Pages plugin contains a logic error that inverts nonce validation in the new comments AJAX handler. Valid nonces are rejected while missing or invalid nonces are accepted. This flaw enables unauthenticated attackers to forge comment submissions on behalf of logged\u2011in users via a simple browser request, provided the victim is tricked into visiting a crafted link and the plugin\u2019s template mode is active. The vulnerability does not give direct code execution or data exfiltration but allows attackers to inject arbitrary comments, potentially spread spam or phishing links, and degrade user trust. The weakness is a classic Cross\u2011Site Request Forgery (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. Attack readiness requires an unauthenticated user to lure an authenticated visitor to a forged request; therefore, realistic attackers would likely need social engineering or a compromised site. Given the low exploitation probability, the risk to a site with strict user moderation may be moderate but could be higher where comment spam tolerance is low."}}}}, "created": "2026-01-07T10:08:01.522135+00:00", "updated": "2026-04-22T16:00:12.102337+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}