Cyber Posture

CVE-2025-1514

High

Published: 26 March 2025

Published
26 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0049 65.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-1514 is a vulnerability in the Active Products Tables for WooCommerce WordPress plugin, affecting all versions up to and including 1.0.6.7. It arises from insufficient restrictions on the get_smth() function, which allows unauthorized filter calling. This enables unauthenticated attackers to invoke arbitrary WordPress filters using a single parameter. The issue is classified under CWE-20 (Improper Input Validation) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-03-26.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction or privileges required. By calling the unrestricted get_smth() function, they can trigger arbitrary WordPress filters with a single parameter, potentially compromising low levels of confidentiality, integrity, and availability depending on the filters invoked.

References from Wordfence and WordPress plugin trac provide details on the vulnerability, including vulnerable code in index.php at line 1753 and a related changeset. Security practitioners should review these advisories for mitigation guidance, such as applying available patches to versions beyond 1.0.6.7.

Details

CWE(s)
CWE-20

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability allows unauthenticated remote exploitation of a public-facing WordPress plugin via arbitrary filter invocation, directly enabling initial access through T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References