CVE-2025-14364

CVE-2025-14364 Demo Importer Plus Authenticated Subscriber → Administrator viado-reinstall AJAX action 〔 1 〕 Vulnerability Root Cause: Ajax::handlerequest registers the demoimporterplus AJAX action without calling currentusercan. Any authenticated subscriber can send "demoaction":"do-reinstall" t...