PT-2025-50861 · WordPress · Bmlt Wordpress Plugin

Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-14162

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions BMLT WordPress Plugin versions up to and including 3.11.4

Description The BMLT WordPress Plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by a lack of nonce validation on the BMLTPlugin create option and BMLTPlugin delete option actions. An unauthenticated attacker could create new plugin settings through a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update the BMLT WordPress Plugin to a version newer than 3.11.4.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14162

Affected Products

Bmlt Wordpress Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14162 · Security Note
• https://plugins.trac.wordpress.org/browser/bmlt-wordpress-satellite-plugin/tags/3.11.4/vendor/bmlt/bmlt-satellite-base-class/bmlt-cms-satellite-plugin.php#L848 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0344f49b-f5f9-4729-ade0-cba6289406de?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bmlt-wordpress-satellite-plugin/trunk/vendor/bmlt/bmlt-satellite-base-class/bmlt-cms-satellite-plugin.php#L848 · Note
• https://t.me/CVEtracker/39560 · Telegram Post