PT-2026-2814 · WordPress · News/Blog Designer Bundle

Itthidej Aramsri · CVE-2025-14502 · Publicado 2026-01-14 · Atualizado 2026-01-19

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The News and Blog Designer Bundle plugin for WordPress versions prior to 1.2

Description The plugin is susceptible to a Local File Inclusion issue via the template parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads and inclusion are permitted.

Recommendations Update to version 1.2 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-98

Identificadores relacionados

CVE-2025-14502

Produtos afetados

News/Blog Designer Bundle

Referências · 7

• https://twitter.com/TheHackerWire/status/2011333014760866149 · Publicação no Twitter
• https://twitter.com/cracbot/status/2013204852302917994 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2011382982251090115 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php#L31 · Nota
• https://twitter.com/VulmonFeeds/status/2011431455696547979 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14502 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=cve · Nota