Security Alert Summary
The Demo Importer Plus plugin for WordPress contains a missing capability check in the Ajax::handle_request() function (all versions up to and including 2.0.8). This allows authenticated users with Subscriber-level access and above to trigger a full site reset that drops database tables (except users and usermeta) and re-runs wp_install(), which results in loss of data and elevation of the attacking account to the Administrator role.
CVE Details
- CVE ID: CVE-2025-14364
- Affected component: Demo Importer Plus plugin for WordPress
- Affected versions: All versions up to, and including, 2.0.8
- Published: December 18, 2025 at 10:16:11 AM UTC
- Last modified: December 18, 2025 at 3:07:18 PM UTC
- CVSS v3.1: Base Score 8.8, Severity: HIGH; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Authentication required — privileges required: Low (authenticated user; CVE description specifies Subscriber-level access and above); user interaction: None
- Primary impacts: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-862
Technical Details
The vulnerability exists because the plugin’s Ajax::handle_request() function lacks a capability check. Without verifying the caller’s capabilities, authenticated users with low-level privileges can invoke the Ajax handler to perform destructive actions. According to the CVE description, exploitation can trigger a full site reset that drops all database tables except the users and usermeta tables and then re-executes wp_install(). That reinstallation step also assigns the Administrator role to the attacking account (privilege escalation).
The issue directly enables data loss (dropped tables) and privilege escalation (Subscriber account becoming Administrator) when the vulnerable Ajax handler is invoked by an authenticated user. The CVE description names the affected function (Ajax::handle_request()) and the install routine (wp_install()) involved in the observed impact.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who have editor/contributor roles, and external contractors or contributors who have Subscriber-level accounts. If a user with Subscriber-level access is able to trigger the vulnerable Ajax endpoint, they could cause the site to lose content, settings, custom post types, product data, and other tables while retaining user accounts. The attacker’s account could then be granted Administrator privileges, allowing further changes to site settings and installed plugins.
Practical consequences include loss of site content and configuration, disruption of services or storefronts, and increased risk of targeted follow-up attacks (for example, phishing that leverages administrative access or exposure of account details). If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (fixed version is not specified in the CVE entry).
- Review and reduce unnecessary user roles and permissions, especially for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected database changes or role changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
