CVE-2025-14629 Overview
CVE-2025-14629 affects the Alchemist Ajax Upload plugin for WordPress in all versions up to and including 1.1. The vulnerability stems from a missing capability check on the delete_file function. Unauthenticated attackers can send crafted requests to delete arbitrary WordPress media attachments from affected sites.
The weakness is classified as Missing Authorization [CWE-862]. Exploitation does not require authentication, user interaction, or elevated privileges. The impact is limited to integrity loss through deletion of media files, with no direct confidentiality or availability compromise to the WordPress core.
Critical Impact
Unauthenticated remote attackers can delete arbitrary media attachments hosted on vulnerable WordPress sites, leading to content loss and potential site disruption.
Affected Products
- Alchemist Ajax Upload plugin for WordPress, versions up to and including 1.1
- WordPress sites with the plugin activated
- All sites using the vulnerable delete_file endpoint
Discovery Timeline
- 2026-01-24 - CVE-2025-14629 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14629
Vulnerability Analysis
The Alchemist Ajax Upload plugin exposes a delete_file function that accepts requests to remove media attachments. The function does not verify the caller's WordPress capabilities or authentication state before performing the deletion. As a result, any anonymous HTTP client can invoke the endpoint and request removal of media library entries.
This class of flaw falls under Broken Access Control. The plugin treats the AJAX endpoint as a trusted operation, while WordPress security guidance requires every state-changing handler to call current_user_can() and verify a nonce. Both controls are absent in the vulnerable handler at line 231 of alchemist_ajax_upload.php.
Root Cause
The root cause is the absence of a capability check inside the delete_file handler. Without a call to current_user_can('delete_post') or an equivalent permission gate, the handler executes its deletion logic for any caller. The missing nonce verification compounds the issue by allowing cross-origin requests to trigger the action.
Attack Vector
An attacker reaches the vulnerable endpoint over the network by sending an HTTP POST request to the plugin's AJAX action. The request supplies the target attachment identifier and triggers deletion without any session cookie or authentication header. No social engineering or victim interaction is required.
The vulnerability is described in prose because no verified exploit code is publicly published. Technical details of the affected handler are available in the WordPress Plugin File Browser and the Wordfence Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-14629
Indicators of Compromise
- Unexpected HTTP POST requests to admin-ajax.php referencing the delete_file action from unauthenticated sources
- Missing or deleted entries in the WordPress media library that were not removed by authorized users
- Web server access log entries showing repeated calls to the plugin's AJAX endpoint from a single external IP
- Absent or invalid wp_nonce parameters in requests targeting the plugin
Detection Strategies
- Inspect WordPress audit logs for media deletion events that lack an associated authenticated user
- Correlate web server logs against the WordPress wp_posts table to identify attachments removed without administrative action
- Deploy web application firewall rules that flag unauthenticated requests to the Alchemist Ajax Upload action
Monitoring Recommendations
- Enable plugin and media activity logging through a WordPress audit plugin or external SIEM forwarder
- Forward admin-ajax.php request logs to a central log platform for query and alerting
- Alert on anomalous spikes in attachment deletion events relative to baseline activity
How to Mitigate CVE-2025-14629
Immediate Actions Required
- Deactivate the Alchemist Ajax Upload plugin until a patched version is published by the maintainer
- Restrict access to admin-ajax.php for unauthenticated users through a web application firewall where feasible
- Restore deleted media from backups and review the WordPress media library for unauthorized changes
- Audit user accounts and recent activity to confirm no follow-on actions occurred
Patch Information
At the time of NVD publication, no fixed version is listed in the available references. Site administrators should monitor the WordPress Plugin Overview and the Wordfence Vulnerability Report for an updated release that adds capability and nonce checks to the delete_file handler.
Workarounds
- Remove the plugin entirely if its functionality is not required for the site
- Apply a WAF rule that blocks requests containing the delete_file action parameter from unauthenticated sources
- Limit administrative AJAX endpoints to authenticated sessions using server-side access controls or IP allowlisting
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
