CVE-2025-14037 - Vulnerability Analysis

Overview

Invelity Product Feeds plugin for WordPress <= 1.2.6 contains a path traversal vulnerability caused by missing validation in the 'createManageFeedPage' function, letting authenticated administrators delete arbitrary files via crafted requests, exploit requires user interaction.

Severity & Score

Impact

Authenticated administrators can delete arbitrary files on the server, potentially leading to system compromise or data loss.

Mitigation

Update to the latest version beyond 1.2.6.

References

• http://plugins.trac.wordpress.org/browser/invelity-products-feeds/trunk/classes/admin/classPluginSettingsManageFeedPage.php?marks=60#L60
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🟠 CVE-2025-14037 - High (8.1) The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. Thi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14037/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner