PT-2026-1556 · WordPress · Amp For Wp – Accelerated Mobile Pages

Rafał · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14468

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to and including 1.1.9

Description The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is a result of flawed nonce verification within the amp theme ajaxcomments AJAX handler, which incorrectly rejects valid nonces while accepting missing or invalid ones. This allows attackers to submit comments as authenticated users if they can trick a user into performing an action, such as clicking a malicious link, and the plugin’s template mode is enabled.

Recommendations Update the AMP for WP – Accelerated Mobile Pages plugin to a version newer than 1.1.9.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14468

Affected Products

Amp For Wp – Accelerated Mobile Pages

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14468 · Security Note
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L698 · Note
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.9/templates/template-mode/template-mode.php#L119 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3426181%40accelerated-mobile-pages%2Ftrunk&old=3402644%40accelerated-mobile-pages%2Ftrunk&sfp_email=&sfph_mail=#file4 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0d195034-4617-474d-a4b1-b299c1607f89?source=cve · Note
• https://twitter.com/CVEnew/status/2008771279957205377 · Twitter Post
• https://t.me/CVEtracker/41569 · Telegram Post