CVE-2025-14437 is a high-severity Sensitive Information Exposure vulnerability affecting all versions up to 3.18.0 of the Hummingbird Performance plugin for WordPress. Rated 7.5 HIGH, this flaw allows unauthenticated attackers to remotely extract sensitive data, including Cloudflare API credentials, with low attack complexity and no user interaction. While not yet listed in CISA's KEV catalog and without public exploits in common databases like Metasploit, it is on the "Hot List" and community discussions indicate exploit code, potentially for Nuclei, has been identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Wpmudev | Hummingbird Performance – Cache & Page Speed Optimization For Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | >= 0, <= 3.18.0CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.