PT-2025-52218 · WordPress · Sweet Energy Efficiency

Paolo Tresso · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-14618

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sweet Energy Efficiency plugin for WordPress versions through 1.0.6

Description The Sweet Energy Efficiency plugin for WordPress is susceptible to unauthorized access, modification, and data loss. This is due to a missing capability check on the sweet energy efficiency action AJAX handler. Authenticated attackers with subscriber-level access or higher can read, modify, and delete arbitrary graphs.

Recommendations Update the Sweet Energy Efficiency plugin to a version beyond 1.0.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14618

Affected Products

Sweet Energy Efficiency

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14618 · Security Note
• https://plugins.trac.wordpress.org/changeset/3417589/sweet-energy-efficiency · Note
• https://t.me/cveNotify/146189 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3420909/sweet-energy-efficiency · Note
• https://twitter.com/CVEnew/status/2001728078603747430 · Twitter Post
• https://t.me/CVEtracker/40148 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1ccc8b30-1bdf-4335-85a9-79c6f9a88afc?source=cve · Note