CVE-2025-14428: 
WordPress vulnerability analysis and mitigation

CVE-2025-14428 is a Missing Authorization vulnerability in the "My Sticky Elements" WordPress plugin (formally: All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs). The flaw allows authenticated attackers with Subscriber-level access or higher to delete all contact form leads stored by the plugin due to a missing capability check on the my_sticky_elements_bulks function. All versions up to and including 2.3.3 are affected; version 2.3.4 introduces the fix. It was disclosed on January 1, 2026, with a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence).

The vulnerability is classified as CWE-862 (Missing Authorization). The my_sticky_elements_bulks function in mystickyelements-admin.php (around line 1788) does not perform a capability check before executing bulk deletion of contact form leads, meaning any authenticated WordPress user — including those with the lowest default role (Subscriber) — can invoke this function over the network without any additional privileges or user interaction. The vulnerable code path is publicly visible in the WordPress plugin repository (WordPress Trac), and the patch is available in changeset 3423407 (WordPress Changeset).

Successful exploitation results in permanent, unauthorized deletion of all contact form leads stored by the plugin, constituting a data integrity and availability loss for site operators. There is no confidentiality impact (no data exposure), and the scope is limited to the plugin's lead data. While the impact is confined to the plugin's stored records, loss of all lead data could have significant business consequences for organizations relying on the plugin for customer contact management (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability requires authentication (at minimum a Subscriber account), which limits opportunistic exploitation but does not eliminate risk on sites with open registration. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence).

1. Obtain a low-privilege account: Register or obtain a Subscriber-level (or higher) account on the target WordPress site running My Sticky Elements ≤ 2.3.3.
2. Authenticate: Log in to the WordPress site with the low-privilege account to obtain a valid session cookie or nonce.
3. Identify the bulk delete endpoint: Locate the AJAX action or admin endpoint that invokes the my_sticky_elements_bulks function (referencing the plugin's admin PHP code at mystickyelements-admin.php).
4. Send the bulk delete request: Craft and submit an HTTP POST request to the WordPress admin-ajax endpoint (e.g., wp-admin/admin-ajax.php) with the appropriate action parameter targeting my_sticky_elements_bulks, using the authenticated session. No capability check is performed, so the request is accepted.
5. Confirm data deletion: All contact form leads stored by the plugin are permanently deleted from the database (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with an action parameter related to my_sticky_elements_bulks from unexpected or low-privilege user accounts.
• Database: Sudden complete absence of contact form lead records in the plugin's database table, particularly if not preceded by any administrative bulk-delete action by a site administrator.
• Application Logs: WordPress debug logs (if enabled) recording invocations of the my_sticky_elements_bulks function by non-administrative user roles.

Update the My Sticky Elements plugin to version 2.3.4 or later, which introduces the required capability check on the my_sticky_elements_bulks function (WordPress Changeset). Site administrators should also audit user accounts with Subscriber-level access, especially on sites with open registration, and consider disabling open registration if not required. No configuration-based workaround is available for unpatched versions; upgrading is the only effective remediation (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 1, 2026. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure and standard CVE aggregator coverage has been identified (Wordfence).