CVE-2025-14037
Published: 21 March 2026
Summary
CVE-2025-14037 is a high-severity CSRF (CWE-352) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-14037 is a vulnerability in the Invelity Product Feeds plugin for WordPress, affecting all versions up to and including 1.2.6. It enables arbitrary file deletion through path traversal due to missing validation and sanitization in the 'createManageFeedPage' function. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H) and is associated with CWE-352.
Authenticated administrator-level attackers can exploit this vulnerability by tricking an administrator into clicking a malicious link. This user interaction allows the delivery of specially crafted requests containing path traversal sequences, enabling the deletion of arbitrary files on the server and potentially disrupting site integrity and availability.
Advisories reference the vulnerable code location at line 60 in the plugin's classPluginSettingsManageFeedPage.php file, as shown in the WordPress Trac repository, and provide additional threat intelligence via Wordfence.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208918
Vulnerability details
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible…
more
for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress plugin enables remote arbitrary file deletion by authenticated admins (via crafted CSRF link).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing validation and sanitization in the createManageFeedPage function, preventing path traversal sequences from enabling arbitrary file deletion.
Mandates timely flaw remediation for the specific vulnerability in Invelity Product Feeds plugin versions up to 1.2.6, eliminating the exploitable code path.
Generates audit records for file deletion events triggered by crafted requests, allowing detection of unauthorized administrator actions exploiting the path traversal.