CVE-2025-14540
Unauthorized Data Access in Userback WordPress Plugin
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | userback_plugin | 1.0.15 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Userback plugin for WordPress, where a missing capability check on the userback_get_json function allows authenticated users with Subscriber-level access or higher to access sensitive plugin configuration data. This includes the Userback API access token and the content of the site's posts and pages, even those marked as private or draft.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information such as the Userback API access token and private or draft content from the WordPress site. This could allow attackers to misuse the API token or gain access to confidential site content, potentially compromising site security and privacy.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Userback plugin for WordPress to a version later than 1.0.15 where the missing capability check on the userback_get_json function is fixed. Additionally, restrict Subscriber-level access if possible and monitor for unauthorized access attempts to sensitive plugin configuration data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Subscriber-level access and above to extract sensitive plugin configuration data, including the Userback API access token and site content such as private and draft posts/pages. Unauthorized access to such data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information. Exposure of API tokens and private content may result in unauthorized data disclosure, undermining compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability on your system, you should check if the Userback WordPress plugin is installed and its version is 1.0.15 or earlier. You can do this by inspecting the plugin files or querying the WordPress plugin list. Additionally, monitoring for unauthorized access attempts to the AJAX action 'userback_get_json' can help identify exploitation attempts. For example, you can search your web server logs for requests to admin-ajax.php with the action=userback_get_json parameter. A sample command to search Apache logs might be: `grep 'action=userback_get_json' /var/log/apache2/access.log`. Also, checking the plugin version via WP-CLI can be done with: `wp plugin list --field=version --name=userback`. If the version is <= 1.0.15, the site is vulnerable. [2]