CVE-2025-14892

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Feb 12, 2026

CISA due date

—

The record

The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.

Affected packages

Ecosystem	Package	Introduced	Fixed