Is CVE-2025-14067 actively exploited?

No active exploitation of CVE-2025-14067 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-14067 be exploited remotely?

Yes. CVE-2025-14067 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-14067?

CVE-2025-14067 has a CVSS score of 5.3 (MEDIUM) and an EPSS exploitation probability of 0.04%.

HOME VULNERABILITIESCVE-2025-14067

MEDIUM

CVE-2025-14067

CWE-862Published: February 14, 2026· Updated: Feb 18, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.6th

Official Description

The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).

NVD Source

Technical Analysis

CVE-2025-14067 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.