← Database

CVE-2025-14629

MEDIUM CVSS: 5.3 Published: 2026-01-24 Modified: 2026-06-17

Description

The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments.

Affected Platforms

Unknown

Weakness Type

CWE-862

References