PT-2026-1732 · WordPress · Wp Page Permalink Extension

Abhirup Konwar · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14172

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Page Permalink Extension versions prior to 1.5.5

Description The WP Page Permalink Extension plugin for WordPress is susceptible to a missing authorization issue. This occurs because of a lack of authorization checks within the cwpp trigger flush rewrite rules function, which is connected to the wp ajax cwpp trigger flush rewrite rules action. Authenticated attackers with Subscriber-level access or higher can flush the site's rewrite rules by manipulating the action parameter.

Recommendations Update the WP Page Permalink Extension plugin to version 1.5.5 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14172

Affected Products

Wp Page Permalink Extension

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14172 · Security Note
• https://plugins.trac.wordpress.org/browser/change-wp-page-permalinks/trunk/change-wp-page-permalinks.php#L188 · Note
• https://twitter.com/CVEnew/status/2009589652932509830 · Twitter Post
• https://t.me/CVEtracker/41836 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c5ba37d7-8fde-4ee3-93db-d2459da34bc4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/change-wp-page-permalinks/tags/1.5.4/change-wp-page-permalinks.php#L188 · Note