Home

Description

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.

PUBLISHED Reserved 2025-12-04 | Published 2026-03-21 | Updated 2026-04-08 | Assigner Wordfence




HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

Any version
affected

Timeline

2025-11-12:Discovered
2026-03-20:Disclosed

Credits

Muhammad Yudha - DJ finder

References

www.wordfence.com/...-7486-4dbe-a79d-702fd6be9cfa?source=cve

plugins.trac.wordpress.org/...ngsManageFeedPage.php?marks=60

cve.org (CVE-2025-14037)

nvd.nist.gov (CVE-2025-14037)

Download JSON