PT-2026-2814 · WordPress · News/Blog Designer Bundle

Itthidej Aramsri · Published 2026-01-14 · Updated 2026-01-19 · CVE-2025-14502

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The News and Blog Designer Bundle plugin for WordPress versions prior to 1.2

Description The plugin is susceptible to a Local File Inclusion issue via the template parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads and inclusion are permitted.

Recommendations Update to version 1.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-98

Related Identifiers

CVE-2025-14502

Affected Products

News/Blog Designer Bundle

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14502 · Security Note
• https://twitter.com/TheHackerWire/status/2011333014760866149 · Twitter Post
• https://twitter.com/cracbot/status/2013204852302917994 · Twitter Post
• https://twitter.com/CVEnew/status/2011382982251090115 · Twitter Post
• https://plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php#L31 · Note
• https://twitter.com/VulmonFeeds/status/2011431455696547979 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=cve · Note