Missing Authorization Vulnerability in Frontend Post Submission Manager Lite by WordPress

CVE-2025-14080

What is CVE-2025-14080?

The Frontend Post Submission Manager Lite plugin for WordPress has a missing authorization flaw that affects all versions up to and including 1.2.5. This vulnerability arises from insufficient authorization checks during the post update process in the fpsml_form_process AJAX action, allowing unauthenticated users to exploit the guest posting functionality. By manipulating the post_id parameter, attackers can change titles, content, excerpts, and even alter post authors, posing a significant risk to the integrity of the site's content.

References