Cyber Resilience

CVE-2025-14866

High

Published: 23 January 2026

Published
23 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 28.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-14866 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-14866 is a privilege escalation vulnerability in the Melapress Role Editor plugin for WordPress, affecting all versions up to and including 1.1.1. The flaw arises from a misconfigured capability check in the 'save_secondary_roles_field' function, classified under CWE-863 (Incorrect Authorization). It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By targeting the flawed function, they can assign themselves elevated roles, including Administrator, enabling full control over the WordPress installation.

References include source code locations in the plugin's WordPress trac repository for version 1.1.0, such as classes/admin/additional-form-fields/class-user-profile.php at line 103 and classes/admin/ajax/class-admin-ajax.php, along with changeset 3439348 and a Wordfence threat intelligence report detailing the vulnerability.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with…

more

Subscriber-level access and above, to assign themselves additional roles including Administrator.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct privilege escalation via flawed authorization check allowing role elevation from subscriber to administrator.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-64421Shared CWE-863
CVE-2026-41404Shared CWE-863
CVE-2024-44305Shared CWE-863
CVE-2026-4639Shared CWE-863
CVE-2026-41344Shared CWE-863
CVE-2025-27822Shared CWE-863
CVE-2026-47101Shared CWE-863
CVE-2025-0359Shared CWE-863
CVE-2024-13282Shared CWE-863
CVE-2026-22806Shared CWE-863

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces approved authorizations for access to system resources, directly countering the misconfigured capability check that allowed unauthorized role assignments.

prevent

Implements least privilege to restrict user capabilities, preventing subscriber-level attackers from escalating to administrator roles.

prevent

Manages account creation, modification, and review to ensure roles are assigned only with proper authorization, mitigating self-escalation via the flawed plugin function.

References