{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14364", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T17:54:27.227Z", "datePublished": "2025-12-18T09:21:30.392Z", "dateUpdated": "2026-04-08T17:35:21.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:35:21.722Z"}, "affected": [{"vendor": "kraftplugins", "product": "Demo Importer Plus", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account."}], "title": "Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9364a9-18f8-47d3-b992-e39c8d99d6ea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3420645/demo-importer-plus/trunk/inc/Ajax.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-09T18:12:50.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-17T21:19:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T14:42:43.099572Z", "id": "CVE-2025-14364", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T14:46:19.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T14:42:43.099572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T14:46:14.602Z"}}], "cna": {"title": "Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "kraftplugins", "product": "Demo Importer Plus", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-09T18:12:50.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-17T21:19:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9364a9-18f8-47d3-b992-e39c8d99d6ea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3420645/demo-importer-plus/trunk/inc/Ajax.php"}], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:35:21.722Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14364", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:35:21.722Z", "dateReserved": "2025-12-09T17:54:27.227Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-18T09:21:30.392Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account."}], "id": "CVE-2025-14364", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-18T10:16:11.410", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3420645/demo-importer-plus/trunk/inc/Ajax.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9364a9-18f8-47d3-b992-e39c8d99d6ea?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:22:22.839979+00:00", "value": {"mitigation_remediation": ["Upgrade Demo Importer Plus to the newest version that incorporates the missing capability check (2.0.9 or later).", "If an update is not yet available, temporarily disable or uninstall the plugin until a patch is released. ", "Apply a temporary safeguard by adding a capability requirement to the Ajax handler or removing the Ajax endpoint altogether, following the vendor\u2019s guidance."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation and Site Reset"}, "threat_synthesis": {"affected_systems": "It affects the WordPress plugin Demo Importer Plus provided by kraftplugins, specifically all versions up to and including 2.0.8.", "description_and_impact": "The Demo Importer Plus plugin for WordPress suffers from a missing capability check in its Ajax handler, allowing any authenticated user with at least Subscriber privileges to invoke a full site reset. This operation drops all database tables except those storing users and user metadata, re\u2011runs WordPress\u2019s installation process, and in the process promotes the attacker's account to Administrator, thereby granting full control over the site.", "risk_and_exploitability": "The CVSS score of 8.8 classifies the vulnerability as high severity, although the EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not listed in CISA KEV. An attacker who is already authenticated as a Subscriber can trigger the exploit by sending a crafted Ajax request; the missing capability check permits execution without further privileges, leading to a complete site reset and privilege escalation to Administrator. Because of the severe impact on confidentiality, integrity, and availability, administrators should consider the vulnerability a high priority even though exploitation likelihood is low."}}}}, "created": "2025-12-19T09:16:24.690876+00:00", "updated": "2026-04-20T21:30:18.573994+00:00", "vendors": ["kraftplugins", "kraftplugins$PRODUCT$demo_importer_plus", "wordpress", "wordpress$PRODUCT$wordpress"]}