Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion

Successful exploitation of CVE-2025-14037 could lead to severe consequences for WordPress websites using the Invelity Product Feeds plugin. An attacker, posing as an administrator or tricking an administrator into clicking a malicious link, can delete critical system files, configuration files, or even application code. This could result in complete website downtime, data loss, and potential compromise of the underlying server. The ability to delete arbitrary files significantly expands the attack surface and allows for potential privilege escalation or further exploitation of the system. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file system structures to gain unauthorized access and control.

1. Réservé2025-12-04
2. Publiée2026-03-21
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-28

The primary mitigation for CVE-2025-14037 is to upgrade the Invelity Product Feeds plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests containing path traversal sequences (e.g., '../'). Additionally, restrict administrator access and carefully review any links clicked by administrators. Monitor WordPress logs for suspicious file deletion attempts. After upgrading, verify the integrity of critical system files and configurations to ensure no unauthorized changes have occurred.

Installations actives

30

Note du plugin