CVE-2025-14037

High

Published: 21 March 2026

Published

21 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

EPSS Score 0.0004 12.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14037 is a high-severity CSRF (CWE-352) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the missing validation and sanitization in the createManageFeedPage function, preventing path traversal sequences from enabling arbitrary file deletion.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation for the specific vulnerability in Invelity Product Feeds plugin versions up to 1.2.6, eliminating the exploitable code path.

AU-12 Audit Record Generation partial match

detect

Generates audit records for file deletion events triggered by crafted requests, allowing detection of unauthorized administrator actions exploiting the path traversal.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing WordPress plugin enables remote arbitrary file deletion by authenticated admins (via crafted CSRF link).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible…

for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.

Deeper analysisAI

CVE-2025-14037 is a vulnerability in the Invelity Product Feeds plugin for WordPress, affecting all versions up to and including 1.2.6. It enables arbitrary file deletion through path traversal due to missing validation and sanitization in the 'createManageFeedPage' function. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H) and is associated with CWE-352.

Authenticated administrator-level attackers can exploit this vulnerability by tricking an administrator into clicking a malicious link. This user interaction allows the delivery of specially crafted requests containing path traversal sequences, enabling the deletion of arbitrary files on the server and potentially disrupting site integrity and availability.

Advisories reference the vulnerable code location at line 60 in the plugin's classPluginSettingsManageFeedPage.php file, as shown in the WordPress Trac repository, and provide additional threat intelligence via Wordfence.