CVE-2025-14446: 
WordPress vulnerability analysis and mitigation

CVE-2025-14446 is a missing authorization vulnerability in the Popup Builder (Easy Notify Lite) plugin for WordPress, developed by GhozyLab. The flaw allows authenticated attackers with Subscriber-level access or above to reset plugin settings to their default values by exploiting a missing capability check on the easynotify_cp_reset() function. All versions up to and including 1.1.37 are affected. It was published on December 13, 2025, with a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-862 (Missing Authorization) — the easynotify_cp_reset() function in the plugin's enoty-functions.php file does not perform a capability check before executing a settings reset operation. Any authenticated WordPress user, including those with the lowest default role (Subscriber), can invoke this function via a crafted request, bypassing intended administrative controls. The vulnerable code is publicly visible in the plugin's source repository (WordPress Trac, Wordfence).

Successful exploitation allows an authenticated attacker to reset the Popup Builder plugin's configuration to default values without authorization, resulting in low integrity and low availability impact. This could disrupt popup campaigns, notification settings, or other plugin-managed content, potentially affecting site functionality and user experience. There is no confidentiality impact, and the scope is limited to the affected WordPress installation (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Easy Notify Lite (Popup Builder) plugin version ≤1.1.37 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft the reset request: Send an authenticated HTTP POST or GET request to the WordPress admin AJAX endpoint (or the relevant plugin action) that triggers the easynotify_cp_reset() function, without requiring any additional capability or nonce validation.
4. Achieve unauthorized settings reset: The plugin settings are reset to their default values, disrupting any configured popup or notification campaigns on the target site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints invoking easynotify_cp_reset from low-privilege user accounts.
• Application: Unexpected reset of Easy Notify Lite plugin settings to defaults, particularly if no administrator performed such an action.
• User Activity: Subscriber or low-privilege user accounts making repeated or unusual requests to plugin admin functions in WordPress audit logs.

Users should update the Easy Notify Lite (Popup Builder) plugin to a version beyond 1.1.37 that includes a proper capability check on the easynotify_cp_reset() function. As a workaround, site administrators can restrict user registration or limit Subscriber-level account creation to trusted users until a patched version is available. Monitoring WordPress audit logs for unauthorized plugin reset actions is also recommended (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a missing authorization issue affecting the Easy Notify Lite plugin (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.