What is the CVSS score of CVE-2025-14446?

CVE-2025-14446 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-14446

MEDIUM

Missing Authorization (CWE-862)

2025-12-13 security@wordfence.com

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Dec 13, 2025 - 16:16 nvd

MEDIUM 5.4

DescriptionCVE.org

The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset plugin settings to their default values.

AnalysisAI

Popup Builder (Easy Notify Lite) plugin for WordPress versions up to 1.1.37 allows authenticated attackers with Subscriber-level access to reset plugin settings to default values due to missing capability checks in the easynotify_cp_reset() function. The vulnerability requires user authentication and does not grant elevated privileges or information disclosure, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active exploitation has been identified at time of analysis, though the issue poses moderate risk to WordPress installations relying on plugin configuration integrity.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a common WordPress plugin flaw where administrative functions fail to verify user capabilities before execution. The easynotify_cp_reset() function in the Easy Notify Lite plugin processes reset requests without calling wp_verify_nonce() or checking current_user_can() for admin-level capabilities. This allows any authenticated WordPress user-including those with minimal Subscriber role-to trigger the reset endpoint via AJAX or direct requests. The affected code is located in inc/functions/enoty-functions.php at line 304, as confirmed by both the tagged release (version 1.1.37) and trunk branches in the WordPress plugin repository.

Affected ProductsAI

WordPress plugin Popup Builder (Easy Notify Lite) versions 1.1.37 and earlier (CPE: wordpress_plugin/easy-notify-lite) are affected. The vulnerability exists across all versions up to and including the latest tagged release 1.1.37, as documented in the WordPress plugin repository trac browser. Organizations using any version of Easy Notify Lite should evaluate their current deployment version and initiate patching. Detailed vulnerability information is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f67ab0cf-340d-4234-a857-1883f91c3ab6.

RemediationAI

Update the Easy Notify Lite plugin to version 1.1.38 or later, which includes capability checks in the easynotify_cp_reset() function to restrict reset functionality to users with admin-level permissions. WordPress administrators should navigate to Plugins > Installed Plugins in the WordPress dashboard, locate Popup Builder (Easy Notify Lite), and apply the update immediately. For sites with automatic plugin updates enabled, the patch will be deployed automatically. No workarounds are available short of deactivating the plugin. Verify the update by confirming the version in wp-content/plugins/easy-notify-lite/ and review plugin settings after patching to ensure no unintended resets occurred.