CVE-2025-14892: Privilege Escalation in Prime Listing Manager

The impact of CVE-2025-14892 is severe. An attacker exploiting this vulnerability can achieve full administrative control over the WordPress site without needing any credentials. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user information, database contents), and potentially compromise the entire server infrastructure. The lack of authentication required makes this vulnerability particularly dangerous, as it can be exploited by anyone with access to the site's URL. This is akin to a complete bypass of security controls, allowing for unrestricted access and manipulation of the website’s functionality and data.

1. Reserved2025-12-18
2. Published2026-02-12
3. Modified2026-04-02
4. EPSS updated2026-03-23

Due to the lack of a fixed version, immediate mitigation is crucial. The primary recommendation is to temporarily disable the Prime Listing Manager plugin until a patch is released. If disabling is not feasible, consider implementing strict access controls and monitoring for suspicious activity. While a direct workaround is unavailable, implementing a Web Application Firewall (WAF) with rules to block unauthorized access attempts to the plugin's administrative functions can provide a temporary layer of protection. Regularly review WordPress security best practices and ensure all other plugins and themes are up to date to minimize the overall attack surface.