CVE-2025-1514

High

Published: 26 March 2025

Published

26 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0019 41.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1514 is a high-severity Improper Input Validation (CWE-20) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates CWE-20 improper input validation in the get_smth() function by requiring validation of inputs to prevent unauthorized arbitrary WordPress filter calls.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to restrict unauthenticated remote access to the vulnerable get_smth() function.

SI-2 Flaw Remediation good match

preventrecover

Requires timely identification, reporting, and remediation of the plugin flaw allowing unauthorized filter invocation, such as patching to versions beyond 1.0.6.7.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress plugin via arbitrary filter invocation, directly enabling initial access through T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible…

for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.

Deeper analysisAI

CVE-2025-1514 is a vulnerability in the Active Products Tables for WooCommerce WordPress plugin, affecting all versions up to and including 1.0.6.7. It arises from insufficient restrictions on the get_smth() function, which allows unauthorized filter calling. This enables unauthenticated attackers to invoke arbitrary WordPress filters using a single parameter. The issue is classified under CWE-20 (Improper Input Validation) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-26.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction or privileges required. By calling the unrestricted get_smth() function, they can trigger arbitrary WordPress filters with a single parameter, potentially compromising low levels of confidentiality, integrity, and availability depending on the filters invoked.

References from Wordfence and WordPress plugin trac provide details on the vulnerability, including vulnerable code in index.php at line 1753 and a related changeset. Security practitioners should review these advisories for mitigation guidance, such as applying available patches to versions beyond 1.0.6.7.