CSRF Vulnerability in WP DB Booster for WordPress

CVE-2025-14168

What is CVE-2025-14168?

The WP DB Booster plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation on the cleanup_all AJAX action. This vulnerability allows unauthenticated attackers to exploit this oversight, potentially leading to the deletion of critical data such as post drafts, revisions, comments, and metadata. An attacker could execute this by tricking a site administrator into clicking a malicious link, thereby triggering a forged request without the administrator’s consent.

References