CVE-2025-14610
Published: 28 January 2026
Summary
CVE-2025-14610 is a high-severity SSRF (CWE-918) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-14610 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting the TableMaster for Elementor plugin for WordPress in all versions up to and including 1.3.6. The issue arises in the Data Table widget, where the plugin fails to restrict which URLs can be fetched during CSV data import via the 'csv_url' parameter. This has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Authenticated attackers with Author-level access or higher can exploit this vulnerability by supplying a malicious 'csv_url' value. This allows them to force the server to make web requests to arbitrary locations, including localhost and internal network services, potentially enabling the reading of sensitive files such as wp-config.php.
References include WordPress plugin trac browser links to the vulnerable code at line 446 in data-table.php for both the 1.3.6 tag and trunk, a specific changeset, and a Wordfence threat intelligence page detailing the vulnerability (ID: ef07d6b0-ccdb-4b33-817f-6d4b3ad96243). No patch details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206417
Vulnerability details
The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricting which URLs can be fetched when importing CSV data from a…
more
URL in the Data Table widget. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations, including localhost and internal network services, and read sensitive files such as wp-config.php via the 'csv_url' parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF directly enables server-side fetching of internal/local URLs, facilitating data access from local system (e.g., wp-config.php) and internal network service discovery.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the csv_url input to reject arbitrary or internal URLs before any server-side fetch occurs.
Enforces policy-based restrictions on information flows so the server cannot be induced to retrieve content from unapproved internal or external destinations.
Limits Author-role capabilities so that only explicitly authorized accounts can invoke the CSV import function that triggers the SSRF.