CVE-2025-14741

Critical

Published: 09 January 2026

Published

09 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0005 14.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14741 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to information and system resources, directly addressing the missing capability check in the delete_object function that allowed unauthenticated deletions of posts, pages, products, terms, and users.

SI-2 Flaw Remediation good match

preventrecover

Requires timely identification, reporting, and correction of system flaws, enabling remediation of this vulnerability by updating the plugin to version 3.28.26 which adds the authorization checks.

AC-6 Least Privilege partial match

prevent

Employs least privilege to restrict access to only necessary permissions, mitigating unauthorized delete actions by unauthenticated attackers lacking required capabilities.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

T1531 Account Access Removal Impact

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

attack.mitre.org →

Why these techniques?

Missing authorization in public WordPress plugin directly enables remote unauthenticated exploitation (T1190) resulting in arbitrary data deletion (T1485) and account removal (T1531).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it…

possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.

Deeper analysisAI

CVE-2025-14741 is a missing authorization vulnerability (CWE-862) in the Frontend Admin by DynamiApps plugin for WordPress. The issue stems from a missing capability check in the 'delete_object' function, affecting all versions up to and including 3.28.25. This flaw enables unauthorized data modification and deletion, with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows deletion of arbitrary posts, pages, products, taxonomy terms, and user accounts, potentially disrupting site functionality and data integrity.

The Wordfence threat intelligence advisory details the vulnerability and provides context on exploitation. A code reference in version 3.28.26 of the plugin highlights changes around lines 106, 119, 132, and 142 in class-delete-object.php, indicating the addition of authorization checks as the fix. WordPress site administrators should update to version 3.28.26 or later to mitigate the issue.