CVE-2025-14070
Published: 07 January 2026
Summary
CVE-2025-14070 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-14070 is a vulnerability in the Reviewify plugin for WordPress, affecting all versions up to and including 1.0.7. It stems from a missing capability check on the 'send_test_email' AJAX action, enabling unauthorized modification of data. Classified under CWE-862 (Missing Authorization), the issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and was published on 2026-01-07.
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely over the network with low complexity. By leveraging the unprotected AJAX endpoint, they can create arbitrary WooCommerce discount coupons, potentially leading to financial loss for the store owner.
Advisories and patch details are referenced in sources including the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/9db8756a-a177-4d39-b169-dc874cac2b3b?source=cve) and WordPress plugin Trac repositories. The vulnerability is evident in code at https://plugins.trac.wordpress.org/browser/review-for-discount/tags/1.0.6/admin/class-xswcrd-review-discounts-admin.php#L425 and trunk equivalent, with a fix in changeset 3434387 (https://plugins.trac.wordpress.org/changeset/3434387/).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1311
Vulnerability details
The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Contributor-level…
more
access and above, to create arbitrary WooCommerce discount coupons, potentially causing financial loss to the store.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization check on WordPress AJAX endpoint directly enables remote exploitation of a public-facing web application to perform unauthorized actions (coupon creation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the missing capability check on the AJAX endpoint that allows unauthorized data modification.
Implements least privilege to restrict Contributor-level users from performing high-privilege actions like creating WooCommerce discount coupons.
Mandates timely remediation of the plugin flaw via patching, eliminating the missing authorization vulnerability.