CVE-2025-14080
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This allows unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, including changing titles, content, excerpts, and removing post authors.
Risk Assessment
An unauthenticated attacker can modify site content, leading to defacement, disinformation, and potential use for further attacks.
Recommendation
Update the Frontend Post Submission Manager Lite plugin to a version later than 1.2.5 or disable it if no fix is available, and review posts for unauthorized changes.
Other vulnerabilities in Frontend Post Submission Manager Lite
Original NVD description (English source)
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS