CVE-2025-14502 is a critical Local File Inclusion vulnerability in the News and Blog Designer Bundle WordPress plugin (versions up to 1.1). The vulnerability arises from improper control of the filename used in an include/require statement via the 'template' parameter, classified under CWE-98. This allows unauthenticated remote attackers to include arbitrary PHP files on the server, resulting in remote code execution. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet, and no known exploits in the wild have been reported.

Successful exploitation enables unauthenticated attackers to execute arbitrary PHP code on the affected server. This can lead to bypassing access controls, unauthorized data disclosure, and full system compromise. The vulnerability affects all versions up to and including 1.1 of the plugin. Given the critical CVSS score of 9.8, the impact on confidentiality, integrity, and availability is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or uninstalling the News and Blog Designer Bundle plugin to prevent exploitation. Avoid uploading or allowing PHP files that could be included via the vulnerable parameter. Monitor trusted security sources for updates on patches or temporary mitigations.