rootharpy/cve-2025-14172-nuclei-templateThe WP Page Permalink Extension plugin (<= 1.5.4) allows authenticated users with insufficient privileges to trigger the AJAX action cwpp_trigger_flush_rewrite_rules due to missing authorization checks.
This repository features a Nuclei template specifically designed to detect a Missing Authorization Vulnerability (CVE-2025-14172) in the WP Page Permalink Extension WordPress plugin. This issue allows authenticated attackers to remotely flush the site's rewrite rules via a vulnerable AJAX action.
CVE-2025-14172 arises from missing authorization checks on the cwpp_trigger_flush_rewrite_rules function hooked to the wp_ajax_cwpp_trigger_flush_rewrite_rules AJAX action in the WP Page Permalink Extension plugin for WordPress. This allows authenticated attackers, with subscriber-level access and above, to flush the site's rewrite rules, which can lead to performance degradation or SEO disruption on affected WordPress sites.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LThis Nuclei template attempts to detect the vulnerability by sending an authenticated request to admin-ajax.php with the action=cwpp_trigger_flush_rewrite_rules parameter and checks for the specific response status or success confirmation.
To use this template with Nuclei, make sure Nuclei is installed on your system. Then run the following command:
nuclei -t path/to/CVE-2025-14172.yaml -u <target_url>
Replace path/to/CVE-2025-14172.yaml with the actual path to your template file and <target_url> with the target website URL.
This template was developed by RootHarpy. For inquiries, collaboration, or contributions, feel free to connect via GitHub.