PT-2026-20612 · WordPress · Remove Post Type Slug

Published 2026-02-19 · Updated 2026-02-19 · CVE-2025-14167

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Remove Post Type Slug versions up to and including 1.0.2

Description The Remove Post Type Slug plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of flawed nonce validation, where the logic uses OR (||) instead of AND (&&). This allows an attacker to modify the plugin’s post type slug removal settings through a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update the Remove Post Type Slug plugin to a version later than 1.0.2.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14167

Affected Products

Remove Post Type Slug

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14167 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c463a1d4-14c8-460a-ad83-6f3b38f1e4e8?source=cve · Note
• https://plugins.trac.wordpress.org/browser/remove-post-type-slug/trunk/admin/class-remove-post-type-slug-admin.php#L127 · Note
• https://twitter.com/CVEnew/status/2024501272993530229 · Twitter Post
• https://t.me/CVEtracker/45072 · Telegram Post
• https://plugins.trac.wordpress.org/browser/remove-post-type-slug/tags/1.0.2/admin/class-remove-post-type-slug-admin.php#L127 · Note