Vulnerability · Published Dec 18, 2025 · Assigned by Wordfence
CVE-2025-14437Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
High 7.5
In plain English
A high-severity sensitive data in logs in Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN from wpmudev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpmudev | Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | 0 – through 3.18.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N