CVE-2025-14080: 
WordPress vulnerability analysis and mitigation

CVE-2025-14080 is a Missing Authorization vulnerability in the Frontend Post Submission Manager Lite plugin for WordPress, affecting all versions up to and including 1.2.5. The flaw allows unauthenticated attackers to modify arbitrary WordPress posts by supplying a post_id parameter through the guest posting form's AJAX action (fpsml_form_process), enabling changes to post titles, content, excerpts, and removal of post authors. It was disclosed on December 20–21, 2025, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): the fpsml_form_process AJAX action, which handles post updates via the guest posting form, performs no authorization or capability checks before processing the request. An unauthenticated attacker can craft an HTTP POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with the action set to fpsml_form_process and an arbitrary post_id value, causing the plugin to update the targeted post without verifying the requester's identity or permissions. The vulnerable code path is visible in the plugin's source at includes/cores/ajax-process-form.php around line 104 (Wordfence, WordPress Trac).

Successful exploitation allows any unauthenticated network attacker to tamper with the content, title, excerpt, and authorship of any post on an affected WordPress site, directly compromising site integrity and visitor trust. While there is no confidentiality or availability impact (no data exfiltration or denial of service), the ability to silently alter published content could be used for defacement, disinformation, SEO manipulation, or removal of attribution. The scope is limited to the WordPress installation running the vulnerable plugin version (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.048%, indicating a low probability of near-term exploitation (Wordfence). However, the lack of authentication requirements and the straightforward nature of the attack (a simple AJAX POST request) make it trivially exploitable by any attacker who identifies a vulnerable site.

1. Reconnaissance: Identify WordPress sites running the Frontend Post Submission Manager Lite plugin (version ≤ 1.2.5) using tools like WPScan, Shodan, or by checking the plugin's readme.txt at https://target.com/wp-content/plugins/frontend-post-submission-manager-lite/readme.txt.
2. Identify target post IDs: Browse the target WordPress site to enumerate post IDs (visible in post URLs, e.g., ?p=42, or via the WordPress REST API at /wp-json/wp/v2/posts).
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to https://target.com/wp-admin/admin-ajax.php with the body parameters: action=fpsml_form_process, post_id=<target_post_id>, and the desired modified values for post_title, post_content, post_excerpt, or post_author.
4. Confirm modification: Visit the targeted post on the site to verify that the content, title, excerpt, or author has been changed as specified in the request.
5. Repeat at scale: Automate the above request across multiple post IDs to perform mass content defacement or author removal across the site (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with action=fpsml_form_process and a post_id parameter from unexpected or external IP addresses.
• Logs: WordPress access logs showing repeated POST requests to admin-ajax.php with the fpsml_form_process action from non-authenticated sessions; web server logs showing high-frequency requests to this endpoint.
• Content Changes: Unexpected modifications to post titles, content, excerpts, or author fields in the WordPress database (wp_posts table), particularly for posts not recently edited by legitimate users.
• WordPress Audit Logs: If an audit logging plugin is installed, entries showing post updates without an associated authenticated user or with a guest/anonymous user context.

Site administrators should update the Frontend Post Submission Manager Lite plugin to a version beyond 1.2.5 that includes authorization checks on the fpsml_form_process AJAX action; the fix is referenced in the plugin's changeset (WordPress Changeset). If an updated version is not yet available or cannot be applied immediately, disabling the plugin is the safest workaround. Additionally, deploying a Web Application Firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with the fpsml_form_process action can provide interim protection (Wordfence).

Wordfence, as the reporting CNA, published the vulnerability details in their threat intelligence database. The vulnerability received standard aggregation coverage from security tracking platforms including Vulners, CVEFeed, Tenable, and ENISA's EUVD. No notable researcher commentary, vendor statements beyond the Wordfence advisory, or significant social media discussion has been identified for this vulnerability.