CVE-2025-14172

Name of the Vulnerable Software and Affected Versions WP Page Permalink Extension versions prior to 1.5.5

Description The WP Page Permalink Extension plugin for WordPress is susceptible to a missing authorization issue. This occurs because of a lack of authorization checks within the cwpp trigger flush rewrite rules function, which is connected to the wp ajax cwpp trigger flush rewrite rules action. Authenticated attackers with Subscriber-level access or higher can flush the site's rewrite rules by manipulating the action parameter.

Recommendations Update the WP Page Permalink Extension plugin to version 1.5.5 or later.