CVE-2025-14795: 
WordPress vulnerability analysis and mitigation

CVE-2025-14795 is a Cross-Site Request Forgery (CSRF) vulnerability in the Stop Spammers Classic plugin for WordPress, affecting all versions up to and including 2026.1. The flaw allows unauthenticated attackers to add arbitrary email addresses to the spam allowlist by tricking a site administrator into clicking a malicious link. It was disclosed on January 28, 2026, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing nonce validation in the ss_addtoallowlist class of the plugin (Wordfence). Because the class does not verify a WordPress nonce before processing allowlist additions, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the server to add attacker-specified email addresses to the spam allowlist. Exploitation requires social engineering — the attacker must trick a logged-in administrator into clicking a crafted link or visiting a malicious page. The vulnerable code path is visible in the plugin's source at classes/ss_addtoallowlist.php (WordPress Trac).

Successful exploitation allows an attacker to manipulate the spam allowlist, effectively whitelisting arbitrary email addresses and bypassing the plugin's spam protection mechanisms. This is an integrity-only impact — there is no confidentiality or availability effect — but it can enable spam accounts or malicious actors to register or interact with the WordPress site without being blocked. The scope is limited to the affected plugin's functionality and does not directly lead to remote code execution or privilege escalation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14795. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator must be tricked into triggering the forged request), which limits its practical exploitability (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Stop Spammers Classic plugin (versions ≤ 2026.1) using tools like WPScan or passive enumeration.
2. Craft forged request: Construct a malicious HTML page or URL that submits a POST request to the target WordPress site's admin endpoint handled by the ss_addtoallowlist class, including the attacker's desired email address as a parameter.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other means, inducing them to click it while authenticated to the WordPress admin panel.
4. Allowlist manipulation: Upon the administrator's interaction, the forged request is processed without nonce validation, adding the attacker-specified email address to the spam allowlist — bypassing the plugin's spam filtering for that address (Wordfence, WordPress Trac).

• Logs: WordPress admin action logs showing unexpected additions to the Stop Spammers allowlist, particularly from IP addresses not associated with legitimate administrators.
• Database: Unexpected or unfamiliar email addresses appearing in the Stop Spammers Classic allowlist table in the WordPress database.
• Network: HTTP POST requests to WordPress admin endpoints associated with ss_addtoallowlist originating from unusual referrers or external domains.

The vulnerability was partially patched in version 2026.1 of the Stop Spammers Classic plugin; users should update to the latest available version beyond 2026.1 once a full patch is released (Wordfence, WordPress Trac). As a workaround, administrators should exercise caution when clicking links from untrusted sources while logged into the WordPress admin panel. Enabling a Web Application Firewall (WAF) with CSRF protection rules can also help mitigate exploitation risk.

The vulnerability was reported and disclosed by Wordfence, which maintains the authoritative advisory (Wordfence). Coverage has been limited to automated vulnerability aggregators and minor security blogs, with no notable researcher commentary or significant community discussion observed.