CVE-2025-14892 in Prime Listing Manager Plugin
Summary
by MITRE • 02/12/2026
The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/13/2026
The Prime Listing Manager WordPress plugin version 1.1 contains a critical security vulnerability that allows unauthenticated attackers to escalate privileges and gain full administrative access to compromised websites. This vulnerability stems from a hardcoded secret value that should have been dynamically generated and securely stored within the plugin's configuration. The flaw enables attackers to bypass all authentication mechanisms and execute arbitrary actions with complete administrative privileges, making it particularly dangerous for WordPress installations that rely on this plugin for property listing management and real estate website functionality.
The technical implementation of this vulnerability involves a hardcoded cryptographic secret or authentication token that remains static across all plugin installations. This hardcoded value is typically embedded within the plugin's source code or configuration files, making it discoverable through source code analysis or reverse engineering techniques. The flaw operates at the authentication layer where the plugin validates administrative requests using this predictable secret instead of implementing proper session management or dynamic token generation. According to CWE-798, this represents a weakness where sensitive information is hardcoded in the application, creating a persistent security risk that cannot be easily mitigated without a complete code modification.
The operational impact of this vulnerability extends beyond simple privilege escalation, as attackers can leverage the administrative access to perform a wide range of malicious activities including but not limited to data exfiltration, malware deployment, website defacement, and modification of core site functionality. The vulnerability affects any WordPress installation running the affected plugin version, making it particularly concerning for real estate agencies, property management companies, and businesses that depend on listing management systems. The attack vector requires minimal sophistication as the hardcoded secret can be discovered through simple static code analysis or by examining plugin files, enabling even novice attackers to exploit the vulnerability effectively.
Security practitioners should immediately implement mitigations including disabling or uninstalling the affected plugin until a patched version is available, conducting comprehensive security audits of all WordPress installations, and monitoring for suspicious administrative activities or unauthorized access attempts. The vulnerability aligns with ATT&CK technique T1078 which covers legitimate credentials use, as attackers can leverage the hardcoded secret to impersonate administrators and maintain persistent access to compromised systems. Organizations should also consider implementing network-based detection measures to identify potential exploitation attempts and establish incident response procedures to address unauthorized administrative access. The recommended long-term solution involves upgrading to a patched version of the plugin that implements proper dynamic secret generation, secure configuration management, and robust authentication mechanisms that adhere to modern security standards and best practices.