PT-2026-26798 · WordPress · Invelity Product Feeds

Published 2026-03-21 · Updated 2026-03-21 · CVE-2025-14037

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Invelity Product Feeds plugin for WordPress versions up to and including 1.2.6

Description The Invelity Product Feeds plugin for WordPress is susceptible to arbitrary file deletion through a path traversal issue. This occurs because of inadequate validation and sanitization within the createManageFeedPage function. Authenticated administrators could be tricked into clicking malicious links containing path traversal sequences, allowing attackers to delete arbitrary files on the server.

Recommendations Update the Invelity Product Feeds plugin to a version later than 1.2.6.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14037

Affected Products

Invelity Product Feeds

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14037 · Security Note
• http://plugins.trac.wordpress.org/browser/invelity-products-feeds/trunk/classes/admin/classPluginSettingsManageFeedPage.php?marks=60#L60 · Note
• https://twitter.com/TheHackerWire/status/2035450960454295787 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa?source=cve · Note
• https://twitter.com/RedPacketSec/status/2035460078694731842 · Twitter Post
• https://twitter.com/CVEnew/status/2035237264096469029 · Twitter Post