PT-2025-52576 · WordPress · Frontend Post Submission Manager Lite

Md. Moniruzzaman Prodhan + 1 · Published 2025-12-21 · Updated 2025-12-21 · CVE-2025-14080

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend Post Submission Manager Lite plugin versions through 1.2.5

Description The Frontend Post Submission Manager Lite plugin for WordPress has an issue where authorization checks are missing on the post update functionality within the fpsml form process AJAX action. This allows unauthenticated attackers to modify posts by providing a post id parameter through the guest posting form. Attackers can change post titles, content, and excerpts, and remove post authors. The vulnerable parameter is post id.

Recommendations Update the Frontend Post Submission Manager Lite plugin to a version later than 1.2.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14080

Affected Products

Frontend Post Submission Manager Lite

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14080 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3419835%40frontend-post-submission-manager-lite&new=3419835%40frontend-post-submission-manager-lite&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=cve · Note
• https://twitter.com/CVEnew/status/2002835937487675609 · Twitter Post
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.5/includes/cores/ajax-process-form.php#L104 · Note
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/cores/ajax-process-form.php#L104 · Note
• https://t.me/CVEtracker/40359 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002584007158956072 · Twitter Post