CVE-2025-14358CWE-862

WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability

High · published January 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in the REHub Framework allows sneaky access to features you didn't sign up for! Think of it like a highly exclusive restaurant where anyone can walk into the kitchen and whip up their own meals — that’s how unchecked access can lead to trouble in the REHub Framework! An attacker could exploit this and manipulate site functionality or view sensitive data without proper authorization. This might lead to data leaks or unauthorized changes, leaving your site vulnerable and its integrity compromised!

Put simply

Think of it like a highly exclusive restaurant where anyone can walk into the kitchen and whip up their own meals — that’s how unchecked access can lead to trouble in the REHub Framework! This vulnerability arises due to absent authorization controls, allowing users to bypass Access Control Lists (ACLs) and access functions they shouldn't touch. It affects REHub Framework versions up to and including 19.9.5.

What to do

An attacker could exploit this and manipulate site functionality or view sensitive data without proper authorization. This might lead to data leaks or unauthorized changes, leaving your site vulnerable and its integrity compromised! To mitigate this risk, upgrade to the latest version of the REHub Framework immediately. Ensure that all access functionality has proper authorization checks in place and conduct a thorough audit of permissions. You've got this! By taking these steps, you'll ensure your site’s security is fortified. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-08T09:17Z
EPSS history
Timeline
  • 08 JAN 09:17Z
    WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability
    cvelistv5