PT-2025-52217 · WordPress · Hummingbird Performance

Ismailshadow · CVE-2025-14437 · Published 2025-12-18 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hummingbird Performance plugin for WordPress versions prior to 3.18.1

Description The Hummingbird Performance plugin for WordPress is susceptible to exposure of sensitive information. This affects unauthenticated attackers who can extract data, including Cloudflare API credentials, through the request function.

Recommendations Update the Hummingbird Performance plugin to version 3.18.1 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-14437

Affected Products

Hummingbird Performance

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14437 · Security Note
• https://plugins.trac.wordpress.org/changeset/3421187/hummingbird-performance · Note
• https://twitter.com/CVEnew/status/2001728077236478270 · Twitter Post
• https://t.me/cveNotify/146188 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8755ab3f-ee77-44ea-8620-590f1f1cb333?source=cve · Note
• https://t.me/CVEtracker/40147 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2038496480085082549 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2043861928565493931 · Twitter Post