CVE-2025-14428 is a missing authorization vulnerability (CWE-862) in the premio All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements WordPress plugin. The vulnerability arises from the lack of a capability check in the 'my_sticky_elements_bulks' function, enabling authenticated users with low privileges (Subscriber-level and above) to delete all contact form leads. This affects all plugin versions up to 2.3.3. The CVSS 3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required.

An attacker with Subscriber-level access or higher can delete all contact form leads stored by the plugin, resulting in unauthorized data loss. There is no indication of confidentiality or availability impact beyond data deletion. The vulnerability does not allow remote code execution or privilege escalation beyond the ability to delete stored leads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor user roles carefully. Avoid granting Subscriber or higher privileges to untrusted users to reduce risk of exploitation.