What is the CVSS score of CVE-2025-14037?

CVE-2025-14037 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-14037?

A high-severity vulnerability in the Invelity Product Feeds WordPress plugin allows authenticated administrators to be tricked into deleting critical server files, potentially causing service…

How to fix or mitigate CVE-2025-14037?

Within 24 hours: Disable the Invelity Product Feeds plugin immediately or restrict administrator access to trusted personnel only; audit recent admin activity logs for suspicious file deletion requests. Within 7 days: Implement Web Application Firewall (WAF) rules to block path traversal patterns in plugin requests; conduct a full backup integrity check and review filesystem permissions. Within 30 days: Either replace the plugin with a vetted alternative, upgrade to a patched version if released, or implement network segmentation to limit admin access to WordPress admin interfaces.

WordPress CVE-2025-14037

EUVD-2025-208918 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-f926-gc7c-947h

CSRF WordPress Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2025-208918

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 8.1

DescriptionCVE.org

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.

AnalysisAI

The Invelity Product Feeds plugin for WordPress contains an arbitrary file deletion vulnerability through path traversal in versions up to and including 1.2.6. Authenticated administrators can be socially engineered into clicking malicious links that delete arbitrary server files due to missing validation in the createManageFeedPage function. No evidence of active exploitation (not in KEV) exists, though the vulnerability is publicly documented with technical details available via WordPress plugin repository references.

Technical ContextAI

This vulnerability affects the Invelity Product Feeds WordPress plugin (cpe:2.3:a:invelity:invelity_product_feeds) and stems from CWE-352 (Cross-Site Request Forgery) combined with path traversal weaknesses. The classPluginSettingsManageFeedPage.php file at line 60 in the createManageFeedPage function fails to properly validate and sanitize file path inputs, allowing directory traversal sequences (such as ../) to escape intended directories. While classified as CSRF, the core issue is insufficient input validation enabling path traversal attacks when processing file deletion requests. The WordPress plugin architecture allows plugins to handle file operations, and without proper sanitization, attackers can manipulate file paths to target system-critical files.

RemediationAI

Website administrators should immediately upgrade the Invelity Product Feeds plugin to version 1.2.7 or later if available, or remove the plugin entirely if patches are not yet released by the vendor. Administrators should review Wordfence Threat Intelligence guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa for the latest patch status and security recommendations. As an interim mitigation, implement Web Application Firewall (WAF) rules to detect and block requests containing directory traversal sequences (../, ../../, etc.) targeting the plugin's admin pages, restrict WordPress admin panel access to trusted IP addresses only, and educate administrators about the risks of clicking untrusted links while authenticated to WordPress. Monitor server logs for suspicious file deletion attempts and implement file integrity monitoring for critical system files.