What is the CVSS score of CVE-2025-14064?

CVE-2025-14064 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14064

MEDIUM

Missing Authorization (CWE-862)

2025-12-12 security@wordfence.com

Authentication Bypass WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 5.4

DescriptionCVE.org

The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.

AnalysisAI

BuddyTask plugin for WordPress versions up to 1.3.0 fails to enforce capability checks on multiple AJAX endpoints, allowing authenticated subscribers and above to view, create, modify, and delete task boards in any BuddyPress group regardless of membership or group privacy settings. The CVSS 5.4 (Medium) rating reflects confidentiality and integrity impacts limited to group task data with low attack complexity and no user interaction required, though the actual organizational risk depends on BuddyPress deployment scope and task board sensitivity.

Technical ContextAI

BuddyTask integrates with BuddyPress, a WordPress community plugin that provides group management and access controls. The vulnerability stems from CWE-862 (Missing Authorization) in AJAX endpoint handlers that process task board operations without verifying whether the authenticated user has the required group-level permissions or group membership. The affected AJAX handlers lack capability checks (likely using functions such as current_user_can() with appropriate group context) before executing database modifications on task board records. BuddyPress normally restricts access to private and hidden groups based on membership status, but BuddyTask's AJAX layer bypasses these restrictions by accepting authenticated requests from any subscriber-level user without re-validating group membership or permissions.

Affected ProductsAI

BuddyTask plugin for WordPress in all versions up to and including 1.3.0 is affected. The plugin integrates with BuddyPress and WordPress core. Affected WordPress installations running BuddyTask versions 1.3.0 and earlier are vulnerable. The vulnerability was confirmed in the 1.3.0 release branch and is present in the trunk development version as of the time of discovery, as evidenced by code inspection at multiple AJAX handler locations in the plugin source tree.

RemediationAI

Update BuddyTask to a patched version released after 1.3.0 that includes capability checks on all AJAX endpoints; consult the plugin changelog or the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfe0947-5790-49ba-aa3d-6bc61c12b355?source=cve for the exact patched version number and release date. As an interim workaround, administrators can restrict plugin functionality via access control lists or disable AJAX endpoints via .htaccess or firewall rules until patching is feasible; however, this may break legitimate task board functionality. WordPress administrators should review recent task board modifications by subscriber and contributor accounts in audit logs to detect potential unauthorized changes during the vulnerability exposure period.