CVE-2025-14172 is a missing authorization vulnerability (CWE-862) in the WP Page Permalink Extension WordPress plugin. The vulnerability arises because the `cwpp_trigger_flush_rewrite_rules` function, hooked to the AJAX action `wp_ajax_cwpp_trigger_flush_rewrite_rules`, lacks proper authorization checks. This allows any authenticated user with Subscriber-level privileges or higher to flush the site's rewrite rules via the `action` parameter, potentially impacting site availability or behavior. The vulnerability affects all versions up to 1.5.4. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

An authenticated attacker with Subscriber-level access or above can flush the WordPress site's rewrite rules without proper authorization. This could lead to temporary site disruption or altered URL routing behavior, impacting site availability. There is no direct confidentiality impact, but the integrity of site routing is affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual rewrite rule flush activity. Avoid granting unnecessary privileges to low-level authenticated users. Follow updates from the plugin vendor or WordPress security channels for patches.