CVE-2025-14364 is a high-severity vulnerability in the Demo Importer Plus plugin for WordPress caused by a missing capability check in the Ajax::handle_request() function. This allows authenticated users with low privileges (Subscriber and above) to trigger a full site reset, which drops all database tables except users and usermeta, and re-executes wp_install(). The reinstallation process assigns Administrator privileges to the attacker’s account, enabling privilege escalation and complete site compromise. The vulnerability affects all versions up to and including 2.0.8. No official patch or remediation has been provided as of the published date.

Exploitation of this vulnerability leads to complete loss of site data except user-related tables, unauthorized modification of data, and privilege escalation by granting Administrator rights to a low-privileged authenticated user. This compromises site integrity, availability, and confidentiality, allowing an attacker to fully control the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access and above to trusted users only. Monitor for plugin updates from kraftplugins and apply them promptly once available.