CVE-2025-14608 is an insecure direct object reference vulnerability in the WP Last Modified Info WordPress plugin. The plugin fails to verify that a user has authorization to modify a post before allowing changes to its last modified metadata via the 'bulk_save' AJAX action. This allows authenticated users with Author-level privileges or higher to update metadata on posts they do not own, including those created by Administrators, by manipulating the 'post_ids' parameter. This vulnerability affects all versions up to 1.9.5 and is categorized under CWE-862 (Missing Authorization).

Exploitation of this vulnerability allows an authenticated user with Author-level access or above to alter the last modified metadata of arbitrary posts, potentially misleading site administrators or users about the recency of content changes. There is no direct impact on confidentiality or availability reported. The integrity of post metadata is compromised, which could affect content management and auditing processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor plugin updates from infosatech. Consider disabling or replacing the WP Last Modified Info plugin if unauthorized metadata modification poses a significant risk to your environment.