CVE-2025-14437 Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
Unauthenticated attackers can extract sensitive Cloudflare API credentials from log files in the Hummingbird Performance WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14437?
CVE-2025-14437 is a high-severity vulnerability in wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
Weakness: CWE-532
Which versions are affected by CVE-2025-14437?
How do I fix CVE-2025-14437?
No fix has been published for CVE-2025-14437 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14437 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14437 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-r7mg-q5mv-qg2v.