CVE-2025-1514
Published: 26 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-1514 is a vulnerability in the Active Products Tables for WooCommerce WordPress plugin, affecting all versions up to and including 1.0.6.7. It arises from insufficient restrictions on the get_smth() function, which allows unauthorized filter calling. This enables unauthenticated attackers to invoke arbitrary WordPress filters using a single parameter. The issue is classified under CWE-20 (Improper Input Validation) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-26.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction or privileges required. By calling the unrestricted get_smth() function, they can trigger arbitrary WordPress filters with a single parameter, potentially compromising low levels of confidentiality, integrity, and availability depending on the filters invoked.
References from Wordfence and WordPress plugin trac provide details on the vulnerability, including vulnerable code in index.php at line 1753 and a related changeset. Security practitioners should review these advisories for mitigation guidance, such as applying available patches to versions beyond 1.0.6.7.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress plugin via arbitrary filter invocation, directly enabling initial access through T1190 Exploit Public-Facing Application.