CVEvulnerability

CVE-2025-14437

7.5 HIGH Published 2025-12-18 Modified 2026-10-01 Official page ↗

Status: Deferred
Published: 2025-12-18
Last modified: 2026-10-01
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-532

Description

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.

Weakness · CWE (1)

CWE-532 Insertion of Sensitive Information into Log File weakness

References

https://plugins.trac.wordpress.org/changeset/3421187/hummingbird-performance plugins.trac.wordpress.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/8755ab3f-ee77-44ea-8620-590f1f1cb333?source=cve www.wordfence.com

CVE-2025-14437

Description

Related

Weakness · CWE (1)

References