What is the CVSS score of CVE-2025-14065?

CVE-2025-14065 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14065

MEDIUM

Missing Authorization (CWE-862)

2025-12-12 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 12, 2025 - 12:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.

AnalysisAI

Simple Bike Rental WordPress plugin versions up to 1.0.6 allow authenticated subscribers to retrieve sensitive customer booking data due to missing capability checks on the 'simpbire_carica_prenotazioni' AJAX action. Attackers with subscriber-level access can exfiltrate personally identifiable information including names, email addresses, and phone numbers from all booking records. CVSS 4.3 reflects the moderate severity of unauthorized information disclosure without requiring administrative access.

Technical ContextAI

The vulnerability stems from an AJAX handler ('simpbire_carica_prenotazioni') that lacks proper WordPress capability verification (CWE-862: Missing Authorization). WordPress capabilities control user access to admin functions; the flaw permits any authenticated user at subscriber level or above to invoke this AJAX action directly without capability checks, bypassing intended access controls. The vulnerability is located in the plugin's ajax.php file, where the action handler processes and returns booking records. This is a classic WordPress privilege escalation pattern where subscriber roles-typically limited to managing their own content-gain unauthorized access to administrative data.

Affected ProductsAI

Simple Bike Rental WordPress plugin in all versions up to and including 1.0.6. The plugin is hosted on WordPress.org plugin repository. Organizations using this plugin for bike rental booking management with subscriber-level registrations are at risk. Reference the plugin's changeset history at https://plugins.trac.wordpress.org/changeset/3414692/simple-bike-rental/ and advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06f4e758-3328-4ac1-956a-cfadddd12e53.

RemediationAI

Update Simple Bike Rental to version 1.0.7 or later, which implements proper WordPress capability checks on the vulnerable AJAX action. Site administrators should immediately upgrade via WordPress admin plugin dashboard (Plugins > Installed Plugins > Simple Bike Rental > Update). If immediate patching is not possible, consider temporarily restricting subscriber role creation or limiting subscriber permissions via user role editor plugins until patched. Review booking records and customer PII exposure; if the site is public-facing, consider notifying users of the potential exposure. Confirmation of the patched version is available in the plugin repository changeset history referenced above.