CVE-2025-14172

MEDIUM

WP Page Permalink Extension <1.5.4 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-14172. PoCs published by RootHarpy.

AI-analyzed exploit summary This repository contains a Nuclei template designed to detect CVE-2025-14172, a missing authorization vulnerability in the WP Page Permalink Extension WordPress plugin. The template sends an authenticated request to `admin-ajax.php` to check for the presence of the vulnerability.

Description

The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.

Exploits (1)

nomisec SCANNER
by RootHarpy · poc
https://github.com/RootHarpy/CVE-2025-14172-Nuclei-Template

This repository contains a Nuclei template designed to detect CVE-2025-14172, a missing authorization vulnerability in the WP Page Permalink Extension WordPress plugin. The template sends an authenticated request to `admin-ajax.php` to check for the presence of the vulnerability.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WP Page Permalink Extension Plugin (versions up to and including 1.5.4)
Auth required
Prerequisites: Authenticated access to the WordPress site (subscriber-level or higher)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 6.5
EPSS 0.0038
EPSS Percentile 29.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
infosatech/WP Page Permalink Extension < 1.5.4
Published Jan 09, 2026
Tracked Since Feb 18, 2026