cbcvebase.
CVE-2025-14437
published 2025-12-18

CVE-2025-14437: The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request'…

PriorityP179high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.99%
78.1th percentile
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.

Affected

1 ranges
VendorProductVersion rangeFixed in
wpmudevhummingbird_performance_cache_page_speed_optimization_for_core_web_vitals_critic<= 3.18.0—

Detection & IOCsextracted from sources · hover to see the quote

path/wp-content/wphb-logs/api-debug.log↗
path/wp-content/plugins/hummingbird-performance↗
url/wp-content/wphb-logs/api-debug.log↗
  • →Unauthenticated GET request to /wp-content/wphb-logs/api-debug.log returning HTTP 200 with body containing 'WPHB', 'X-Auth-Key', 'X-Auth-Email', and 'Authorization' strings indicates successful exploitation and exposure of Cloudflare API credentials. ↗
  • →Monitor web server access logs for unauthenticated requests to the path /wp-content/wphb-logs/api-debug.log; successful 200 responses indicate the log file is publicly accessible and credentials may be exposed. ↗
  • →The exposed log file is generated by the Hummingbird 'request' function and contains Cloudflare API credentials (X-Auth-Key, X-Auth-Email, Authorization headers). Presence of the string 'WPHB' in the log body is a reliable indicator of the Hummingbird plugin's debug log. ↗
  • →Shodan/FOFA fingerprint for affected hosts: search for HTTP response bodies containing '/wp-content/plugins/hummingbird-performance'. ↗
  • ·The vulnerability affects all versions of the Hummingbird Performance plugin up to and including 3.18.0. The fix was introduced in the changeset that follows 3.18.0. ↗
  • ·Exploitation requires no authentication whatsoever; any unauthenticated HTTP client can directly fetch the exposed log file if the WordPress installation is reachable. ↗
  • ·The log file only exists and is accessible if the Hummingbird plugin has been configured to use Cloudflare integration and debug logging is active; sites without Cloudflare integration may not have the api-debug.log file present. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.