CVE-2025-14397 is a missing authorization vulnerability in the Postem Ipsum WordPress plugin by franciscopalacios. The issue arises because the postem_ipsum_generate_users() function does not perform proper capability checks, enabling authenticated users with minimal privileges (Subscriber or above) to escalate their privileges by creating arbitrary administrator accounts. This vulnerability affects all versions up to and including 3.0.1. The CVSS 3.1 score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to create new administrator accounts, effectively gaining full control over the affected WordPress site. This leads to complete compromise of site confidentiality, integrity, and availability. There are no reports of active exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the Postem Ipsum plugin if possible. Monitor for updates from the vendor franciscopalacios regarding patches or official mitigations.