CVE-2025-14080 is a missing authorization vulnerability (CWE-862) in the Frontend Post Submission Manager Lite – Frontend Posting WordPress plugin. The issue arises because the plugin's AJAX action fpsml_form_process lacks proper authorization checks on post update functionality. This allows unauthenticated users to modify arbitrary posts by submitting a post_id parameter via the guest posting form. The vulnerability affects all versions up to and including 1.2.5. The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory is currently available.

An unauthenticated attacker can modify arbitrary posts on a vulnerable WordPress site using this plugin. They can alter post titles, content, excerpts, and remove post authors, potentially leading to content tampering and misinformation. There is no direct confidentiality or availability impact reported. The integrity of published content is compromised, which may affect site trustworthiness and user experience.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the Frontend Post Submission Manager Lite plugin if it is not essential. Monitoring for unusual post modifications and restricting access to the affected AJAX endpoint via web application firewall rules may provide temporary mitigation.