CVE-2025-14426 is a missing authorization vulnerability in the Strong Testimonials WordPress plugin by wpchill. The flaw exists in the 'edit_rating' function, which does not verify user capabilities before allowing modification of rating metadata on testimonial posts. Authenticated users with Contributor-level permissions or higher can exploit this by reusing a valid nonce from their own testimonial edit screen to alter or delete ratings on testimonials created by other users. This vulnerability affects all versions up to and including 3.2.18. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with Contributor-level or higher access can modify or delete rating metadata on testimonial posts they do not own. This could lead to unauthorized data modification within the plugin's testimonial ratings, potentially undermining data integrity. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access where possible and monitor for unusual modifications to testimonial ratings. Avoid reusing nonces across testimonial edits to reduce risk. Follow wpchill's official channels for updates and apply patches promptly when available.