CVE-2025-14618: Wpdirectorykit Sweet Energy Efficiency

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on the 'sweet_energy_efficiency_action' AJAX handler in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with subscriber level access and above, to read, modify, and delete arbitrary graphs.

Affected products

• Wpdirectorykit Sweet Energy Efficiency: up to and including 1.0.6

Published 2025-12-18. Last modified 2026-06-17.