Privilege Escalation Vulnerability in Postem Ipsum Plugin for WordPress

CVE-2025-14397

What is CVE-2025-14397?

The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modifications due to a missing capability check in the postem_ipsum_generate_users() function. This vulnerability affects all versions up to and including 3.0.1, enabling authenticated attackers with Subscriber-level access and higher to create arbitrary user accounts with administrator privileges, significantly compromising site security.

References