What is the CVSS score of CVE-2025-13314?

CVE-2025-13314 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-13314

MEDIUM

Missing Authorization (CWE-862)

2025-12-12 security@wordfence.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The Product Filtering by Categories, Tags, Price Range for WooCommerce - Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.

AnalysisAI

Unauthenticated attackers can modify plugin settings and create arbitrary filter options in the Filter Plus plugin for WordPress (versions up to 1.1.6) due to missing capability checks on AJAX actions 'filter_save_settings' and 'add_filter_options'. This allows unauthorized data modification with no confidentiality impact but enables attackers to alter product filtering functionality without authentication. The vulnerability has a low EPSS score (0.08%, 23rd percentile) despite network accessibility, indicating limited real-world exploitation likelihood.

Technical ContextAI

The Filter Plus plugin for WordPress implements AJAX endpoints for managing product filter settings but fails to validate user capabilities before processing requests. The vulnerability stems from CWE-862 (Missing Authorization), where the AJAX actions lack WordPress nonce verification and capability checks (such as current_user_can() calls) required to ensure only authorized administrators can modify settings. The affected code paths in action.php lines 23, 28, and 82 handle filter option creation and settings persistence without proper access controls. WordPress's AJAX handler processes requests from unauthenticated users if the action is registered for 'wp_ajax_nopriv' or if the default AJAX registration fails to restrict access.

Affected ProductsAI

The Filter Plus plugin for WordPress in all versions up to and including 1.1.6 is affected. This is a WordPress plugin hosted on the official WordPress.org plugin repository. The vulnerability was present in version 1.1.5 (as referenced in the plugin repository tags) and remediated in version 1.1.7 or later. The plugin's CPE is not provided in standard form, but it is identified as 'filter-plus' in the WordPress plugin directory.

RemediationAI

Update the Filter Plus plugin to version 1.1.7 or later immediately. Site administrators should navigate to the WordPress plugin dashboard, locate the Filter Plus plugin, and select the update option. Verify the update completes successfully and that the plugin is running the patched version by checking the plugin details. If automatic updates are not enabled, manually download version 1.1.7 or later from the official WordPress plugin repository (plugins.trac.wordpress.org) and upload it via SFTP or the WordPress admin upload interface. As a temporary workaround pending updates, restrict AJAX access through web server configuration if technically feasible, though this may disrupt plugin functionality and is not a long-term solution. Review audit logs to determine if settings were modified during exposure.