CVE-2025-14718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14718", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-15T13:48:03.777Z", "datePublished": "2026-01-09T06:34:54.542Z", "dateUpdated": "2026-04-08T17:03:47.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:47.200Z"}, "affected": [{"vendor": "publishpress", "product": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators."}], "title": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8198d81a-40c0-49c1-8c38-f5ef6fb911ad?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/post-expirator/tags/4.9.3/src/Modules/Workflows/Rest/RestApiV1.php&new_path=/post-expirator/tags/4.9.4/src/Modules/Workflows/Rest/RestApiV1.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-12-12T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-15T14:03:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T17:41:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T19:07:27.902746Z", "id": "CVE-2025-14718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:10:31.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T19:07:27.902746Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:10:29.237Z"}}], "cna": {"title": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "publishpress", "product": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.9.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-15T14:03:38.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T17:41:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8198d81a-40c0-49c1-8c38-f5ef6fb911ad?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/post-expirator/tags/4.9.3/src/Modules/Workflows/Rest/RestApiV1.php&new_path=/post-expirator/tags/4.9.4/src/Modules/Workflows/Rest/RestApiV1.php"}], "descriptions": [{"lang": "en", "value": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:47.200Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14718", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:47.200Z", "dateReserved": "2025-12-15T13:48:03.777Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T06:34:54.542Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories", "vendor": "publishpress", "versions": [{"lessThanOrEqual": "4.9.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators."}, {"lang": "es", "value": "El plugin Schedule Post Changes With PublishPress Future para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 4.9.3, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, puedan crear, actualizar, eliminar y publicar flujos de trabajo maliciosos que pueden eliminar autom\u00e1ticamente cualquier publicaci\u00f3n al ser publicada o actualizada, incluyendo publicaciones creadas por administradores."}], "id": "CVE-2025-14718", "lastModified": "2026-06-17T08:36:26.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14718", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T19:07:27.902746Z", "version": "2.0.3"}}]}, "published": "2026-01-09T07:16:00.967", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/post-expirator/tags/4.9.3/src/Modules/Workflows/Rest/RestApiV1.php&new_path=/post-expirator/tags/4.9.4/src/Modules/Workflows/Rest/RestApiV1.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8198d81a-40c0-49c1-8c38-f5ef6fb911ad?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:33:56.285478+00:00", "value": {"mitigation_remediation": ["Update the PublishPress Future plugin to version 4.9.4 or later, which includes proper authorization checks for workflow operations.", "Remove or downgrade Contributor-level access for users who do not require workflow management capabilities, or apply a role\u2011based access control plugin to enforce stricter permissions.", "Audit existing workflows for suspicious or logically incorrect changes and delete or restore any that appear malicious."], "summary": {"action": "Patch", "impact": "Authorization bypass"}, "threat_synthesis": {"affected_systems": "PublishPress\u2019 PublishPress Future plugin for WordPress, versions up to and including 4.9.3. The vulnerability affects all WordPress sites that have this plugin installed via the WordPress plugin repository or other distribution channels.", "description_and_impact": "The plugin fails to verify user permissions before permitting workflow management operations. Authenticated users with Contributor-level access and above can create, modify, delete, publish or trash content from any user, including administrators. This provides a direct path to delete legitimate posts, publish malicious content, or otherwise tamper with site content. The weakness maps to CWE\u2011862, an authorization bypass flaw.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The plugin is not listed in the CISA KEV catalog. The likely attack vector is local: any authenticated contributor or higher who can log into the WordPress admin area can exploit the missing authorization check to manipulate workflow settings and thereby alter content ownership and visibility. No remote code execution or privilege escalation beyond content manipulation is documented in the description."}}}}, "created": "2026-01-09T13:23:51.685951+00:00", "updated": "2026-04-21T16:45:15.211191+00:00", "vendors": ["publishpress", "publishpress$PRODUCT$schedule_post_changes_with_publishpress_future", "wordpress", "wordpress$PRODUCT$wordpress"]}