Cross-Site Request Forgery in AMP for WP Plugin by WordPress

CVE-2025-14468

What is CVE-2025-14468?

The AMP for WP – Accelerated Mobile Pages plugin for WordPress suffers from a Cross-Site Request Forgery due to faulty nonce verification logic. Specifically, the amp_theme_ajaxcomments AJAX handler is misconfigured to accept requests with invalid or missing nonces while rejecting those with valid nonces. This vulnerability could allow attackers to exploit it by tricking users into executing actions, such as clicking malicious links, enabling the submission of unauthorized comments on their behalf if the plugin's template mode is activated.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References