CVE-2025-14541
Published: 11 February 2026
Summary
CVE-2025-14541 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-14541 is a remote code execution vulnerability in the Lucky Wheel Giveaway plugin for WordPress, affecting all versions up to and including 1.0.22. The issue stems from the plugin executing PHP's eval() function on the user-controlled conditional_tags parameter without proper validation or sanitization, enabling arbitrary code execution on the server.
Authenticated attackers with Administrator-level access or higher can exploit this vulnerability remotely. Exploitation requires network access and low complexity but no user interaction, resulting in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H) and association with CWE-94 (Improper Control of Generation of Code).
Mitigation is addressed in the patch committed to the WordPress plugins trac at changeset 3439141 for the wp-lucky-wheel trunk. Further details on the vulnerability and remediation are provided in the Wordfence threat intelligence advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206938
Vulnerability details
The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags parameter. This is due to the plugin using PHP's eval() function on user-controlled input without proper…
more
validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE in public-facing WordPress plugin via unsanitized eval() on user input, matching Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the conditional_tags parameter before it reaches eval().
Mandates timely application of the vendor patch (changeset 3439141) that removes the unsafe eval() call.
Restricts use of dangerous PHP language features such as eval() on production WordPress servers.