CVE-2025-14037 is a high-severity vulnerability in the Invelity Product Feeds WordPress plugin (up to version 1.2.6) caused by insufficient input validation in the 'createManageFeedPage' function. This flaw allows authenticated administrators to perform arbitrary file deletion on the server through path traversal sequences embedded in malicious requests. The attack requires user interaction (UI:R) and privileges of an administrator (PR:H). The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), indicating that an attacker can exploit the vulnerability by tricking an admin into clicking a crafted link that triggers the file deletion.

Successful exploitation results in the deletion of arbitrary files on the server, impacting the integrity and availability of the affected system. Confidentiality is not impacted. The attacker must have administrator privileges and convince the admin to interact with a malicious link, which limits exploitation scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider restricting administrative access to trusted networks or users. Monitoring for suspicious activity related to the plugin's file management functions is advisable. Do not rely on generic mitigations; focus on vendor updates for this specific vulnerability.