CVE-2025-14864: 
WordPress vulnerability analysis and mitigation

CVE-2025-14864 is a Sensitive Information Exposure vulnerability in the Virusdie – One-click website security plugin for WordPress, affecting all versions up to and including 1.1.7. The flaw allows authenticated attackers with Subscriber-level access or higher to retrieve the site's Virusdie API key, potentially enabling unauthorized access to the site owner's Virusdie account. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is a missing authorization check (CWE-862) on the vd_get_apikey function, which is registered as a WordPress AJAX handler via the wp_ajax_virusdie_apikey hook. Because no capability check is enforced before executing the function, any authenticated WordPress user — regardless of role — can trigger the AJAX action and receive the site's Virusdie API key in the response. Exploitation requires only a valid WordPress login (e.g., a Subscriber account) and a crafted POST request to the wp-admin/admin-ajax.php endpoint with action=virusdie_apikey (Red Hat CVE).

Successful exploitation exposes the site's Virusdie API key to any authenticated WordPress user, which could allow an attacker to access the site owner's Virusdie account and manipulate security settings, disable malware scanning, or obtain sensitive scan results. The confidentiality impact is limited to the API key itself; there is no direct integrity or availability impact on the WordPress installation. However, secondary abuse of the stolen API key could undermine the site's security posture by disabling protective features managed through Virusdie (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level WordPress account, limiting the attack surface to sites that allow open user registration or where an attacker has already obtained low-privilege credentials (Red Hat CVE).

1. Obtain a low-privilege account: Register or log in to the target WordPress site with at minimum a Subscriber-level account.
2. Identify the vulnerable plugin: Confirm the Virusdie plugin (version ≤ 1.1.7) is active on the target site by observing plugin-related assets or admin hints.
3. Craft the AJAX request: Send an authenticated POST request to https://target-site.com/wp-admin/admin-ajax.php with the body parameter action=virusdie_apikey, including the WordPress authentication cookies obtained during login.
4. Retrieve the API key: The server responds with the site's Virusdie API key due to the missing capability check on vd_get_apikey.
5. Abuse the API key: Use the retrieved API key to authenticate to the Virusdie platform, potentially accessing the site owner's account, viewing scan results, or modifying security configurations (Red Hat CVE).

• Network: Repeated authenticated POST requests to /wp-admin/admin-ajax.php with the body parameter action=virusdie_apikey from unexpected or low-privilege user sessions.
• Logs: WordPress access logs showing POST /wp-admin/admin-ajax.php with action=virusdie_apikey originating from Subscriber-level user sessions or unfamiliar IP addresses.
• Logs: Virusdie account activity logs showing logins or configuration changes from unrecognized IP addresses or devices, potentially indicating API key misuse.

Users should update the Virusdie – One-click website security plugin to a version beyond 1.1.7 that includes a proper capability check on the vd_get_apikey AJAX handler. If an immediate update is not possible, site administrators should disable the plugin until a patched version is available, and consider rotating the Virusdie API key via the Virusdie dashboard to invalidate any potentially exposed keys. Restricting WordPress user registration to trusted individuals reduces the attack surface by limiting who can obtain the Subscriber-level access required for exploitation (Red Hat CVE).