CVE-2025-14468

The AMP for WP – Accelerated Mobile Pages WordPress plugin contains a security flaw in versions prior to 1.2 that allows malicious actors to manipulate comments by exploiting a weakness in nonce verification within the amp_theme_ajaxcomments AJAX handler. Specifically, this vulnerability enables an attacker to bypass authentication checks and submit comments on behalf of legitimate users if they can deceive someone into performing a certain action while the plugin's template mode is active.

Based on public CVE data (MITRE/NVD).