CVE-2025-14045

URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload

Published Dec 12, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.

Analysis

Technical impact

The URL Media Uploader plugin for WordPress permits attackers who are logged in with Contributor-level privileges or higher to upload arbitrary safe media files, because the url_media_uploader_url_upload_ajax_handler() function lacks a capability check. This missing authorization allows authenticated users to place files into the site’s media library. The flaw is categorized as CWE‑862: Missing Authorization.

Affected Systems

WordPress installations that use the URL Media Uploader plugin by apprhyme. All releases up to and including version 1.0.1 are affected. Site administrators should confirm the plugin’s presence and version to assess exposure.

Risk and Exploitability

The CVSS score of 4.3 classifies the flaw as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack can be performed by any authenticated user with Contributor access, so the risk level is significant for sites that grant such roles. Patching or mitigating the missing capability check will render the upload endpoint unusable by contributors.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

apprhyme

URL Media Uploader

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the URL Media Uploader plugin to a version that includes a proper capability check, such as 1.0.2 or newer.
If an update is not possible, manually edit the plugin’s upload handler to add a capability check using current_user_can( 'upload_files' ).
Restrict Contributor and higher roles from uploading media by adjusting WordPress role capabilities or disabling the upload feature for those roles.

Generated by OpenCVE AI on April 22, 2026 at 00:16 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.303% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/jasoncarle/925401bb11833b1ced2342390e20718e
https://plugins.trac.wordpress.org/browser/url-media-uploader/tags/1.0.1/url-media-uploader.php#L52
https://plugins.trac.wordpress.org/browser/url-media-uploader/trunk/url-media-uploader.php#L52
https://www.wordfence.com/threat-intel/vulnerabilities/id/57f09da9-0d2c-45db-b3ed-19a7c9f5a001?source=cve

History

Dec 15, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 12, 2025 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Dec 12, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.
Title		URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload
Weaknesses		CWE-862
References		https://gist.github.com/jasoncarle/925401bb11833b1ced2342390e20718e https://plugins.trac.wordpress.org/browser/url-media-uploader/tags/1.0.1/url-media-uploader.php#L52 https://plugins.trac.wordpress.org/browser/url-media-uploader/trunk/url-media-uploader.php#L52 https://www.wordfence.com/threat-intel/vulnerabilities/id/57f09da9-0d2c-45db-b3ed-19a7c9f5a001?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`