Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

News and Blog Designer Bundle plugin for WordPress allows attackers to inject and run unauthorized code

CVE-2025-14502 · published 9 months ago
Summary

The News and Blog Designer Bundle plugin for WordPress is vulnerable to a security threat that allows hackers to inject and run their own code on the server. This can lead to unauthorized access to sensitive data or website compromise. Update to a fixed version of the plugin to protect your website.

Original advisory text
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthe...
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-98Improper Control of Filename for Include
Timeline
Published14 Jan 2026
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-14502 · NVD
Track software like this
Free during beta