CVE-2025-14629: WordPress Alchemist Auth Bypass Flaw

CVE-2025-14629 Overview

The Alchemist Ajax Upload plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) in the delete_file function that allows unauthenticated attackers to delete arbitrary media attachments. This security flaw exists in all versions up to and including version 1.1, exposing WordPress sites to unauthorized file deletion attacks without requiring any authentication.

Critical Impact

Unauthenticated attackers can delete arbitrary WordPress media attachments, potentially disrupting site functionality and causing data loss.

Affected Products

• Alchemist Ajax Upload plugin for WordPress versions up to and including 1.1

Discovery Timeline

• 2026-01-24 - CVE-2025-14629 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-14629

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), a type of Broken Access Control flaw. The delete_file function in the Alchemist Ajax Upload plugin fails to verify whether the user making the request has the appropriate permissions to delete media files. This architectural oversight allows any unauthenticated user to invoke the deletion functionality and remove WordPress media attachments.

The vulnerability is accessible over the network and requires no authentication or user interaction to exploit. While the integrity impact is limited to unauthorized file deletion, this can have significant consequences for WordPress sites that rely on media assets for their content and functionality.

Root Cause

The root cause of this vulnerability is a missing capability check in the delete_file function located in the alchemist_ajax_upload.php file at line 231. WordPress provides built-in functions like current_user_can() to verify user permissions before performing sensitive operations, but this check was not implemented in the vulnerable function.

Proper WordPress development practices require capability checks on all AJAX handlers that perform destructive or privileged operations. The absence of this security control creates an authorization bypass that allows any visitor to trigger the file deletion endpoint.

Attack Vector

The attack vector for CVE-2025-14629 is network-based, allowing remote exploitation. An attacker can craft HTTP requests directly to the vulnerable AJAX endpoint without needing valid WordPress credentials.

The exploitation flow involves:

1. Identifying a WordPress site running a vulnerable version of Alchemist Ajax Upload
2. Crafting a direct request to the delete_file AJAX action
3. Providing the target media attachment ID as a parameter
4. The plugin processes the request without verifying authorization
5. The specified media attachment is deleted from the WordPress installation

Attackers could enumerate attachment IDs to systematically delete media files, or target specific known attachment IDs to disrupt site content. For technical details, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2025-14629

Indicators of Compromise

• Unexpected deletion of media attachments in WordPress media library
• Unusual HTTP POST requests to WordPress admin-ajax.php containing delete_file action from unauthenticated sessions
• Missing images or media files on frontend pages that were previously functional
• Audit logs showing media deletions without corresponding authenticated user sessions

Detection Strategies

• Monitor WordPress admin-ajax.php for requests containing the delete_file action parameter from unauthenticated sources
• Implement Web Application Firewall (WAF) rules to detect and block suspicious AJAX requests targeting the Alchemist Ajax Upload plugin
• Enable comprehensive WordPress activity logging to track media library changes and correlate with user authentication status
• Review access logs for patterns of sequential requests that may indicate attachment ID enumeration

Monitoring Recommendations

• Deploy SentinelOne Singularity to monitor WordPress installations for suspicious file system activity and unauthorized deletions
• Configure alerts for unusual patterns of media file deletions, especially from unauthenticated sessions
• Implement real-time monitoring of WordPress AJAX endpoints for anomalous request patterns
• Maintain regular backups of the WordPress media library to enable rapid recovery if exploitation occurs

How to Mitigate CVE-2025-14629

Immediate Actions Required

• Deactivate and remove the Alchemist Ajax Upload plugin from WordPress installations running version 1.1 or earlier
• Review WordPress media library for any signs of unauthorized deletions
• Restore any deleted media files from backups if unauthorized activity is detected
• Consider implementing a Web Application Firewall to provide additional protection while remediation is completed

Patch Information

As of the last update on 2026-01-26, organizations should check the WordPress Plugin Page for any available security updates. If no patched version is available, the safest approach is to remove the plugin entirely and seek an alternative solution with proper authorization controls. Review the Wordfence Vulnerability Analysis for the latest remediation guidance.

Workarounds

• Disable the plugin completely until a security patch is available from the vendor
• Implement server-level access controls to restrict admin-ajax.php requests containing the vulnerable action
• Use a WAF rule to block unauthenticated requests to the delete_file AJAX action
• Consider implementing custom code to add capability checks if plugin modification is feasible in your environment

# Example .htaccess rule to block unauthenticated delete_file requests
# Add to WordPress root .htaccess file as a temporary mitigation
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wp-admin/admin-ajax.php$ [NC]
RewriteCond %{QUERY_STRING} action=delete_file [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>