Missing Authorization Vulnerability in Frontend Post Submission Manager Lite by WordPress
CVE-2025-14080
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 December 2025
What is CVE-2025-14080?
The Frontend Post Submission Manager Lite plugin for WordPress has a missing authorization flaw that affects all versions up to and including 1.2.5. This vulnerability arises from insufficient authorization checks during the post update process in the fpsml_form_process AJAX action, allowing unauthenticated users to exploit the guest posting functionality. By manipulating the post_id parameter, attackers can change titles, content, excerpts, and even alter post authors, posing a significant risk to the integrity of the site's content.
Affected Version(s)
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin * <= 1.2.5
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Md. Moniruzzaman Prodhan