PT-2025-51081 · WordPress · Userback

Jason Carle · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-14540

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Userback plugin for WordPress versions through 1.0.15

Description The Userback plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check within the userback get json function. Authenticated attackers with Subscriber-level access or higher can extract the plugin’s configuration data, including the Userback API access token and the contents of site posts and pages, even those with private or draft status.

Recommendations Update the Userback plugin to a version newer than 1.0.15.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14540

Affected Products

Userback

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-14540 · Security Note
• https://twitter.com/CVEnew/status/1999865372703596863 · Twitter Post
• https://plugins.trac.wordpress.org/browser/userback/tags/1.0.15/index.php#L148 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1add8693-20df-431e-ad3b-b23322f1fa03?source=cve · Note