Loading vulnerability…
CVE-2025-14364 is a high-severity authorization flaw in the Demo Importer Plus WordPress plugin affecting all versions up to and including 2.0.8. The vulnerability is caused by a missing capability check in the Ajax::handle_request() function. Because the affected AJAX handler does not properly verify whether the requesting user is authorized to perform the action, an authenticated attacker with only Subscriber-level access or higher can invoke functionality intended for privileged users. Successful exploitation allows the attacker to trigger a full site reset that drops all WordPress database tables except users and usermeta, then re-runs wp_install(). As part of that reinstallation flow, the attacking subscriber account is assigned the Administrator role, resulting in privilege escalation alongside destructive modification of site data.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit project centered on CVE-2025-14364, affecting the WordPress Demo Importer Plus plugin <= 2.0.8. The repository contains one main code file (CVE-2025-14364.py), a README describing the vulnerability and workflow, and a custom license. The Python script is the clear entry point and implements an asynchronous multi-target tool using aiohttp, asyncio, urllib3, and colorama. The exploit has three operational modes: (1) diagnostic scanning of supplied targets, (2) WordPress user registration, and (3) authenticated exploitation. In diagnose mode, it probes targets to identify likely live WordPress instances by checking DNS resolution and common WordPress endpoints such as /wp-login.php, /wp-admin/admin-ajax.php, and /wp/v2/users. In register mode, it attempts to create a low-privilege account through /wp-login.php?action=register using operator-supplied email/username/password values. In exploit mode, it logs in with the subscriber credentials, requests /wp-admin/ to extract a REST nonce from page content, then sends a JSON request with {"demo_action":"do-reinstall"} to /wp-admin/admin-ajax.php?action=demo_importer_plus. According to the README and code structure, successful execution resets the site and causes the attacker-controlled account to become an Administrator. The exploit is operational rather than a simple proof of concept because it automates target normalization, concurrent HTTP requests, registration, login, nonce extraction, exploitation, and result logging. However, it is not part of a larger exploitation framework. The payload is not a shell or code-execution payload; instead, it is an application-layer JSON action that abuses missing authorization in the plugin's AJAX handler to perform a privileged site reset and privilege escalation. Notable fingerprintable endpoints include WordPress paths /wp-login.php, /wp-login.php?action=register, /wp-admin/, /wp-admin/admin-ajax.php, /wp-admin/admin-ajax.php?action=demo_importer_plus, and /wp/v2/users. The script also uses local files diagnostics_results.txt, passed_targets.txt, register_results.txt, exploit_results.txt, reset_results.txt, and list.txt for input/output. Overall, the repository's purpose is to mass-test and exploit vulnerable WordPress sites running Demo Importer Plus <= 2.0.8 where attacker registration and subsequent authenticated access are possible.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown
A privilege escalation and site reset vulnerability in the Demo Importer Plus WordPress plugin (<=2.0.8) due to missing authorization checks, allowing authenticated users with Subscriber role or higher to reset the site and gain Administrator privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.