CVE-2025-14437
Published: 18 December 2025
Summary
CVE-2025-14437 is a high-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Hummingbird Performance plugin for WordPress is affected by a sensitive information exposure vulnerability in all versions through 3.18.0. The flaw resides in the request function and permits exposure of sensitive data such as Cloudflare API credentials, corresponding to CWE-532 and carrying a CVSS 3.1 score of 7.5.
Unauthenticated attackers with network access can invoke the affected function without credentials or user interaction to retrieve the exposed credentials and other sensitive configuration details.
The referenced WordPress plugin changeset documents the corrective update that addresses the exposure, while the Wordfence advisory supplies technical details for detection and remediation.
EPSS for the CVE rose from lower values to a peak of 0.5044 on 2026-04-19 before receding to the current 0.3080, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204263
Vulnerability details
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures mandate excluding sensitive data from logs to prevent unauthorized exposure via audit records.
Identifies insertion of sensitive data into logs, allowing detection of unauthorized disclosure.
Cross-organizational coordination enables agreement on what data to include in audit logs, directly reducing insertion of sensitive information.
Identifying logging as a data action allows prevention of sensitive information being inserted into log files.
The process of identifying and eradicating spilled information applies directly to sensitive data inserted into log files.
Specific processing rules for sensitive PII categories commonly include restrictions on logging, making insertion of such data into log files less likely.
PIAs detect planned or existing logging of PII and require removal or protection, preventing insertion of sensitive information into logs.
Limits insertion of sensitive operational details into logs by treating such data as key information requiring protection.