CVE-2025-14426: 
WordPress vulnerability analysis and mitigation

CVE-2025-14426 is a missing authorization vulnerability in the Strong Testimonials plugin for WordPress, allowing authenticated attackers to perform unauthorized modification of testimonial rating data. It affects all versions of the plugin up to and including 3.2.18, developed by WPChill. The vulnerability was published on December 30, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) in the edit_rating function within admin/class-strong-testimonials-post-editor.php. The function fails to verify whether the requesting user has sufficient privileges to modify rating metadata on testimonial posts belonging to other users. An authenticated attacker with Contributor-level access or above can exploit this by reusing a valid nonce obtained from their own testimonial edit screen to target any testimonial post, effectively bypassing authorization controls (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to modify or delete the rating metadata on any testimonial post on the affected WordPress site, including posts created by other users. This impacts data integrity by enabling manipulation of user-generated review content, which could be used to artificially inflate or deflate ratings, undermine trust in the testimonials system, or suppress legitimate user feedback. There is no confidentiality or availability impact associated with this vulnerability (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level authenticated account on the target WordPress site, limiting the attack surface (Wordfence, Red Hat CVE).

1. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) account on the target WordPress site running Strong Testimonials ≤ 3.2.18.
2. Retrieve a Valid Nonce: Navigate to the testimonial edit screen for a testimonial post owned by the attacker's account and capture the nonce value from the edit form or via a network request.
3. Craft a Malicious Request: Construct an HTTP POST request targeting the edit_rating AJAX action (or equivalent endpoint), supplying the captured nonce and the post ID of a testimonial belonging to another user.
4. Modify or Delete Target Rating: Submit the crafted request to modify or delete the rating metadata on the targeted testimonial post. Because the edit_rating function does not verify the requester's capability against the target post, the action succeeds (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to the admin-ajax endpoint (/wp-admin/admin-ajax.php) with the edit_rating action from Contributor-level accounts targeting testimonial post IDs not owned by that user.
• Database: Unexpected changes to testimonial post meta fields (e.g., rating values set to 0 or unusual values) for posts not authored by the modifying user, visible in the wp_postmeta table.
• Logs: WordPress debug or audit logs (if enabled) recording edit_rating calls where the acting user ID does not match the post author ID of the targeted testimonial.

Users should update the Strong Testimonials plugin to version 3.2.19 or later, which addresses the missing capability check via the patch available in the WordPress plugin repository changeset. The fix was committed in changeset 3416480 (WordPress Trac Changeset). As a temporary workaround, site administrators can restrict Contributor-level user registration or remove untrusted Contributor accounts until the plugin is updated. Regularly auditing testimonial rating metadata for unexpected changes is also advisable.

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 30, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence).