CVE-2025-14608: WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
Vulnerability summary
CVE-2025-14608 is a medium (CVSS 5.3) Missing Authorization vulnerability in infosatech wp last modified info. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.3% of scored vulnerabilities. Fixed in 1.9.6.
Timeline
- 14-02-2026PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.24% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Infosatech1 product
- wp last modified info≤ 1.9.5
Wordpress1 product
- wp-last-modified-info≤ 1.9.5 (fixed in 1.9.6)
2 vendors · 2 products