Medium severity4.3NVD Advisory· Published Dec 12, 2025· Updated Apr 15, 2026

CVE-2025-14045

Description

The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.

Affected products

WordPress/URL Media Uploaderinferred
Range: <=1.0.1
Package: https://wordpress.org/plugins/url-media-uploader

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

gist.github.com/jasoncarle/925401bb11833b1ced2342390e20718envd
plugins.trac.wordpress.org/browser/url-media-uploader/tags/1.0.1/url-media-uploader.phpnvd
plugins.trac.wordpress.org/browser/url-media-uploader/trunk/url-media-uploader.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/57f09da9-0d2c-45db-b3ed-19a7c9f5a001nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000