CVE-2025-14437
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 1.94%
- CWE
- CWE-532
- Published
- 2025-12-18
- Last modified
- 2026-04-09
Affected products
- wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
- wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
Weakness type
Related vulnerabilities
- CVE-2026-79966 — CWE-532: Insertion of Sensitive Information into Log File
- CVE-2026-80169 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2025-46808 — Sensitive information is leaked into NeuVector’s manager container logs
- CVE-2026-80124 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-78631 — Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
- CVE-2026-78627 — Improper Credential Protection in Okta Hyperdrive Integration Installer Logging
- CVE-2026-68873 — Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
- CVE-2026-86597 — Sensitive information written to logs by Snowflake drivers