CVE-2025-14608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14608", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-12T20:11:33.221Z", "datePublished": "2026-02-14T03:25:28.248Z", "dateUpdated": "2026-04-08T17:23:18.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:18.991Z"}, "affected": [{"vendor": "infosatech", "product": "WP Last Modified Info", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter."}], "title": "WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca94c815-488f-4d86-a642-39d2de803763?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Backend/EditScreen.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/tags/1.9.5/inc/Core/Backend/EditScreen.php#L249"}, {"url": "https://plugins.trac.wordpress.org/changeset/3450167/"}, {"url": "https://github.com/iamsayan/wp-last-modified-info/commit/cb3586897c11c3cd55dd63b7ae963243a027c0be"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2026-01-21T03:25:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:03:12.057618Z", "id": "CVE-2025-14608", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:04:02.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:03:12.057618Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:03:46.424Z"}}], "cna": {"title": "WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification", "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "infosatech", "product": "WP Last Modified Info", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-21T03:25:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca94c815-488f-4d86-a642-39d2de803763?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Backend/EditScreen.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/tags/1.9.5/inc/Core/Backend/EditScreen.php#L249"}, {"url": "https://plugins.trac.wordpress.org/changeset/3450167/"}, {"url": "https://github.com/iamsayan/wp-last-modified-info/commit/cb3586897c11c3cd55dd63b7ae963243a027c0be"}], "descriptions": [{"lang": "en", "value": "The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:18.991Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14608", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:23:18.991Z", "dateReserved": "2025-12-12T20:11:33.221Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T03:25:28.248Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Last Modified Info", "vendor": "infosatech", "versions": [{"lessThanOrEqual": "1.9.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter."}, {"lang": "es", "value": "El plugin WP Last Modified Info para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 1.9.5, inclusive. Esto se debe a que el plugin no valida el acceso de un usuario a una publicaci\u00f3n antes de modificar sus metadatos en la acci\u00f3n AJAX 'bulk_save'. Esto hace posible que atacantes autenticados, con acceso de nivel Autor o superior, actualicen los metadatos de \u00faltima modificaci\u00f3n y bloqueen la fecha de modificaci\u00f3n de publicaciones arbitrarias, incluyendo aquellas creadas por Administradores a trav\u00e9s del par\u00e1metro 'post_ids'."}], "id": "CVE-2025-14608", "lastModified": "2026-06-17T08:36:15.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14608", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:03:12.057618Z", "version": "2.0.3"}}]}, "published": "2026-02-14T04:15:56.643", "references": [{"source": "security@wordfence.com", "url": "https://github.com/iamsayan/wp-last-modified-info/commit/cb3586897c11c3cd55dd63b7ae963243a027c0be"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/tags/1.9.5/inc/Core/Backend/EditScreen.php#L249"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Backend/EditScreen.php#L249"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3450167/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca94c815-488f-4d86-a642-39d2de803763?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.5]"}}], "product": "wp_last_modified_info", "vendor": "infosatech"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-20T20:54:33.726564+00:00", "value": {"mitigation_remediation": ["Upgrade WP Last Modified Info to a version newer than 1.9.5 where the bulk_save authorization check is enforced (if such a release is available).", "If an upgrade is not immediately possible, restrict the bulk_save AJAX endpoint to administrators only by adding a role check or by disabling the endpoint through a custom code snippet or configuration file.", "Monitor site activity for suspicious bulk_save requests and temporarily block offending IP addresses or users until the plugin can be patched."], "summary": {"action": "Patch Plugin", "impact": "Unauthorized Metadata Modification"}, "threat_synthesis": {"affected_systems": "The issue affects the WP Last Modified Info plugin for WordPress, specifically all releases up to and including version 1.9.5. The plugin is distributed by infosatech. WordPress sites that have this plugin installed and any authenticated user with Author or higher role are at risk.", "description_and_impact": "The vulnerability arises because WP Last Modified Info does not validate that a user has appropriate access before modifying post metadata in the bulk_save AJAX action. As a result, any authenticated user with Author-level privileges or higher can change the last modified timestamp and lock the modification date of any post, including posts owned by administrators. This flaw enables unauthorized modification of post metadata, which can be used to conceal tampering, disrupt auditing processes, or disrupt normal content editing workflows.", "risk_and_exploitability": "With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score indicates a very low likelihood of exploitation (<1%). It is not listed in the CISA KEV catalog, so there is no evidence of widespread commercial exploitation. The attack requires the attacker to be authenticated on the target WordPress site with at least Author-level permissions, and to craft a bulk_save AJAX request that targets arbitrary post IDs. Because the flaw relies on missing authorization checks, it can be weaponized by users already present in the system, but it does not require any additional network access or privilege escalation."}}}}, "created": "2026-02-16T12:03:20.549557+00:00", "updated": "2026-04-20T21:00:12.963900+00:00", "vendors": ["infosatech", "infosatech$PRODUCT$wp_last_modified_info", "wordpress", "wordpress$PRODUCT$wordpress"]}