CVE-2025-14080

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.

• CWE-862

• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.5/includes/cores/ajax-process-form.php#L104
• https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/trunk/includes/cores/ajax-process-form.php#L104
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3419835%40frontend-post-submission-manager-lite&new=3419835%40frontend-post-submission-manager-lite&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=cve

Published

Dec 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14075The WP Hotel Booking plugin for WordPress is vulnerable to S…5.3
• CVE-2025-14076The iXML – Google XML sitemap generator plugin for WordPress…6.1
• CVE-2025-14077The Simcast plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2025-14078The PAYGENT for WooCommerce plugin for WordPress is vulnerab…5.3
• CVE-2025-14079The ELEX WordPress HelpDesk & Customer Ticketing System plug…5.3
• CVE-2025-1408The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2025-14081The Ultimate Member plugin for WordPress is vulnerable to Pr…4.3
• CVE-2025-14082A flaw was found in Keycloak Admin REST (Representational St…2.7
• CVE-2025-14083A flaw was found in the Keycloak Admin REST API. This vulner…2.7
• CVE-2025-14085A vulnerability has been found in youlaitech youlai-mall 1.0…8.8
• CVE-2025-14086A vulnerability was found in youlaitech youlai-mall 1.0.0/2.…8.8
• CVE-2025-14087A flaw was found in GLib (Gnome Lib). This vulnerability all…9.8