CVE-2025-14629

Description

The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments.

PUBLISHED Reserved 2025-12-12 | Published 2026-01-24 | Updated 2026-01-26 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Camilla Flocco finder

References

www.wordfence.com/...-7990-40f3-bb90-3ae359b52c6f?source=cve

wordpress.org/plugins/alchemist-ajax-upload/

plugins.trac.wordpress.org/.../1.1/alchemist_ajax_upload.php

plugins.trac.wordpress.org/...runk/alchemist_ajax_upload.php

cve.org (CVE-2025-14629)

nvd.nist.gov (CVE-2025-14629)

Download JSON