Cyber Resilience

CVE-2025-14892

Critical

Published: 12 February 2026

Published
12 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 28.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-14892 is a critical-severity an unspecified weakness vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and RA-5 (Vulnerability Monitoring and Scanning).

Deeper analysis

CVE-2025-14892 is a critical vulnerability in the Prime Listing Manager WordPress plugin through version 1.1. It arises from a hardcoded secret that allows an attacker to gain administrative access on a targeted WordPress site without needing any kind of account.

The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, and no user interaction required. Unauthenticated attackers can leverage this to obtain full administrative privileges and perform unauthorized actions, such as modifying site content, installing malicious plugins, or exfiltrating data.

Details on mitigation, including patches or workarounds, are provided in the WPScan advisory at https://wpscan.com/vulnerability/d12332ec-1d0c-4ff5-94e0-7c4470bdb79c/. Security practitioners should immediately review and update affected installations.

EU & UK References

Vulnerability details

The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated exploitation of public-facing WordPress plugin via hardcoded secret for admin access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates identification, reporting, and timely remediation of software flaws such as the hardcoded secret in the Prime Listing Manager plugin enabling unauthenticated administrative access.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

Requires vulnerability scanning and monitoring to identify and address exposures like CVE-2025-14892 in WordPress plugins prior to exploitation.

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Prohibits high-privilege actions such as administrative access without identification or authentication, directly countering the CVE's unauthorized access mechanism.

References