CVE-2025-14913

MediumCVSS 5.3

Published: 26/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

22th percentile - higher than 22% of all known CVEs

Summary

The Frontend Post Submission Manager Lite (Frontend Posting) WordPress plugin up to and including version 1.2.6 is vulnerable to unauthorized loss of data due to an incorrect authorization check in the 'media_delete_action' function. This allows unauthenticated attackers to delete arbitrary attachments.

Risk Assessment

An unauthenticated attacker can delete arbitrary media files on the WordPress site, causing data loss and potential destruction of site content.

Recommendation

Update the Frontend Post Submission Manager Lite plugin to a version newer than 1.2.6 or disable it if no fix is available.

Other vulnerabilities in Frontend Post Submission Manager Lite

CVE-2025-14080Medium
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This allows unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, including changing titles, content, excerpts, and removing post authors.

Original NVD description (English source)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS