{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14370", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T18:33:05.097Z", "datePublished": "2026-01-07T06:35:58.733Z", "dateUpdated": "2026-04-08T16:40:51.818Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:51.818Z"}, "affected": [{"vendor": "metodiew", "product": "Quote Comments", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter."}], "title": "Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebe0767-db22-4995-bdf1-5ebb48f960e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quote-comments/tags/3.0.0/quote-comments.php#L309"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "timeline": [{"time": "2026-01-06T18:35:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:52:32.583503Z", "id": "CVE-2025-14370", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:18.126Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:52:32.583503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:52:34.834Z"}}], "cna": {"title": "Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "metodiew", "product": "Quote Comments", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T18:35:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebe0767-db22-4995-bdf1-5ebb48f960e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quote-comments/tags/3.0.0/quote-comments.php#L309"}], "descriptions": [{"lang": "en", "value": "The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:51.818Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14370", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:40:51.818Z", "dateReserved": "2025-12-09T18:33:05.097Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T06:35:58.733Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter."}, {"lang": "es", "value": "El plugin Quote Comments para WordPress es vulnerable a Falta de Autorizaci\u00f3n en todas las versiones hasta la 3.0.0, inclusive. Esto se debe a la falta de comprobaciones de autorizaci\u00f3n en la funci\u00f3n quotecomments_add_admin. Esto permite que atacantes autenticados, con acceso de nivel Suscriptor y superior, actualicen opciones arbitrarias del plugin a trav\u00e9s del par\u00e1metro 'action'."}], "id": "CVE-2025-14370", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-01-07T12:16:54.603", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quote-comments/tags/3.0.0/quote-comments.php#L309"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebe0767-db22-4995-bdf1-5ebb48f960e9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:53:42.605546+00:00", "value": {"mitigation_remediation": ["Upgrade the Quote Comments plugin to the latest available version where the authorization checks have been added.", "Restrict or remove Subscriber-level permissions from the plugin\u2019s administrative actions using a role\u2011management tool or by adjusting capability assignments.", "Audit and review user roles and plugin configuration settings regularly to ensure that only trusted accounts can modify plugin options.", "If an immediate upgrade is not possible, block or filter direct access to the plugin\u2019s admin endpoint through firewall rules or by inserting additional capability checks in a custom WordPress plugin."], "summary": {"action": "Update Plugin", "impact": "Unauthorized Plugin Settings Modification"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Quote Comments plugin versions up to and including 3.0.0 from the vendor metodiew are affected. Versions beyond 3.0.0 are not known to be vulnerable. Site administrators should verify the installed version and upgrade if it falls within the vulnerable range.", "description_and_impact": "The Quote Comments plugin contains missing authentication checks in the quotecomments_add_admin function, enabling any authenticated user with Subscriber privileges or higher to alter plugin options through the action parameter. This flaw grants attackers the ability to modify configuration values, affecting the site's presentation or behavior and potentially opening doors to additional vulnerabilities. The core issue is a loss of configuration integrity, as unauthorized users can change settings that should be protected.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low exploitation probability, and it is not listed in the CISA KEV catalog. Attackers require valid credentials with at least Subscriber level access and the ability to reach the WordPress admin interface. Once authenticated, they can perform arbitrary option updates by sending crafted requests to the plugin\u2019s admin endpoint, as the code path bypasses capability checks."}}}}, "created": "2026-01-08T09:49:42.523138+00:00", "updated": "2026-04-22T16:00:12.100871+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}