CVE-2025-14502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14502", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T20:59:40.217Z", "datePublished": "2026-01-14T05:28:13.366Z", "dateUpdated": "2026-04-08T17:28:40.360Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:40.360Z"}, "affected": [{"vendor": "vaghasia3", "product": "News and Blog Designer Bundle", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php#L31"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2025-12-08T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-13T17:23:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T21:29:00.828784Z", "id": "CVE-2025-14502", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:36:48.570Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T21:29:00.828784Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:35:17.370Z"}}], "cna": {"title": "News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "vaghasia3", "product": "News and Blog Designer Bundle", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-08T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-13T17:23:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php#L31"}], "descriptions": [{"lang": "en", "value": "The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:40.360Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14502", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:40.360Z", "dateReserved": "2025-12-10T20:59:40.217Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T05:28:13.366Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "News and Blog Designer Bundle", "vendor": "vaghasia3", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin News and Blog Designer Bundle para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 1.1, inclusive, a trav\u00e9s del par\u00e1metro 'template'. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede utilizarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se puedan subir e incluir tipos de ficheros .php."}], "id": "CVE-2025-14502", "lastModified": "2026-06-17T08:36:01.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14502", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T21:29:00.828784Z", "version": "2.0.3"}}]}, "published": "2026-01-14T06:15:52.743", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php#L31"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:26:36.262948+00:00", "value": {"mitigation_remediation": ["Upgrade News and Blog Designer Bundle to a version newer than 1.1 to remove the vulnerable template parameter.", "If an upgrade is not immediately possible, configure the plugin or web server to validate the template parameter, allowing only whitelisted paths and rejecting relative or absolute paths that access arbitrary files, thereby mitigating the CWE\u201198 Local File Inclusion weakness.", "Deploy a web application firewall or intrusion detection system that detects and blocks suspicious template parameter values or attempts to include non\u2011existent or disallowed files.", "As a last resort, disable or uninstall the News and Blog Designer Bundle plugin until a secure version is released."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress News and Blog Designer Bundle plugin, specifically versions 1.1 and below. Any site running these versions and leaving the template parameter exposed is at risk.", "description_and_impact": "The News and Blog Designer Bundle plugin for WordPress permits unauthenticated local file inclusion through the template parameter in all releases up to and including 1.1. By providing a crafted value, an attacker can cause the server to include and execute arbitrary .php files located on the filesystem. This allows the adversary to run any PHP code, effectively bypassing access controls, reading sensitive data, or executing arbitrary commands within the web server context.", "risk_and_exploitability": "With a CVSS score of 9.8, the flaw is considered critical. The EPSS score of less than 1% indicates that while exploit attempts are rare, the high severity makes discovery and exploitation still a substantial threat. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local file inclusion via the template parameter, allowing any unauthenticated user to direct the plugin to include files on the server, leading to remote code execution if PHP files can be uploaded or accessed."}}}}, "created": "2026-01-14T10:48:52.374960+00:00", "updated": "2026-04-21T00:30:22.976604+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}