CVE-2025-14168: 
WordPress vulnerability analysis and mitigation

CVE-2025-14168 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP DB Booster plugin for WordPress, affecting all versions up to and including 1.0.1. The flaw allows unauthenticated attackers to delete database records — including post drafts, revisions, comments, and metadata — by tricking a site administrator into clicking a malicious link. It was published on December 20, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat).

The root cause is missing nonce validation on the cleanup_all AJAX action handler in the plugin's admin class (class-wp-db-booster-admin.php, line 336), classified as CWE-352 (Cross-Site Request Forgery). Because WordPress nonces are not verified before executing the cleanup operation, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator's browser session, causes the AJAX action to execute with the administrator's privileges. The attack vector is network-based and requires no privileges from the attacker, only user interaction from the victim administrator (Wordfence, WordPress Trac).

Successful exploitation results in unauthorized deletion of WordPress database records, including post drafts, revisions, comments, and associated metadata, causing data loss and potential integrity degradation of the affected site. Confidentiality and availability are not directly impacted per the CVSS assessment, but the loss of content can disrupt site operations and may be difficult to recover without backups. The scope is limited to the affected WordPress installation and does not facilitate lateral movement or remote code execution (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14168. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick a logged-in administrator into visiting a malicious page or clicking a crafted link (Wordfence, Red Hat).

1. Reconnaissance: Identify WordPress sites using the WP DB Booster plugin version ≤1.0.1 (e.g., via HTTP response headers, plugin enumeration, or public WordPress plugin directories).
2. Craft forged request: Create an HTML page or email containing a hidden form or image tag that submits a POST request to the target site's WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to cleanup_all.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other means, inducing them to visit the page while authenticated to their WordPress dashboard.
4. Trigger CSRF: When the administrator's browser loads the attacker-controlled page, the forged request is automatically submitted using the administrator's active session cookies, bypassing authentication checks.
5. Database cleanup executed: The cleanup_all AJAX action executes without nonce verification, deleting post drafts, revisions, comments, and metadata from the WordPress database (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin-ajax.php with action=cleanup_all from unusual referrer URLs or external origins.
• Database: Sudden mass deletion of records in WordPress tables such as wp_posts (drafts/revisions), wp_comments, and wp_postmeta without corresponding administrator activity in the dashboard.
• Logs: WordPress debug logs or server logs indicating the cleanup_all AJAX action was triggered outside of normal administrative sessions or at unusual times.

Users should update the WP DB Booster plugin to version 1.0.2 or later, which addresses the missing nonce validation on the cleanup_all AJAX action. As an interim measure, administrators can deactivate or remove the plugin until the update is applied. Additionally, implementing a Web Application Firewall (WAF) rule to block unexpected POST requests to admin-ajax.php with the cleanup_all action from external referrers can reduce exposure (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 20, 2025. Coverage has been limited to automated vulnerability aggregators and security databases, with no notable researcher commentary or significant social media discussion observed beyond standard CVE tracking (Wordfence).