CVE-2025-8357: WordPress Media Library Assistant File Deletion

CVE-2025-8357 Overview

The Media Library Assistant plugin for WordPress contains an arbitrary file deletion vulnerability affecting all versions up to and including 3.27. The flaw resides in the _process_mla_download_file function, which fails to properly validate file paths and verify user capabilities before performing deletion operations. Authenticated users with Author-level access or higher can delete arbitrary files within the /wp-content/uploads/ directory. This vulnerability is tracked under CWE-862: Missing Authorization and was disclosed through the Wordfence Vulnerability Report.

Critical Impact
Authenticated attackers with Author-level privileges can delete arbitrary files from the /wp-content/uploads/ directory, potentially disrupting site functionality and removing media assets.

Affected Products

Media Library Assistant plugin for WordPress — all versions up to and including 3.27
WordPress installations where Author-level or higher accounts can register
Multi-author WordPress sites using Media Library Assistant for media management

Discovery Timeline

2025-08-19 - CVE-2025-8357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8357

Vulnerability Analysis

The vulnerability exists in the _process_mla_download_file function within the Media Library Assistant plugin's main class. The function handles file download operations but includes a code path that also performs file deletion. Two independent defects combine to create the flaw: insufficient file path validation and missing capability checks. The plugin accepts user-supplied input that influences the target file path without constraining it to legitimate media attachments.

An authenticated user with Author-level privileges can invoke the vulnerable code path and remove files within the /wp-content/uploads/ directory. While WordPress file-system restrictions limit the scope to the uploads folder, the impact remains significant. Attackers can delete other authors' media files, uploaded assets referenced across the site, or files whose removal degrades site functionality. Full technical context is available in the plugin source code and the vendor changeset.

Root Cause

The root cause is a missing authorization check [CWE-862] combined with inadequate path validation. The _process_mla_download_file function does not call current_user_can() with an appropriate capability such as delete_post or manage_options before deleting the referenced file. It also fails to verify that the supplied file path corresponds to a media attachment owned by or available to the requesting user.

Attack Vector

An attacker authenticates to WordPress using Author-level or higher credentials, then issues a crafted request to the plugin endpoint handled by _process_mla_download_file. By controlling the file path parameter, the attacker triggers deletion of any file located under /wp-content/uploads/. The attack requires network access to the WordPress admin surface and valid authenticated credentials, but no user interaction from administrators.

No verified proof-of-concept code is publicly available. Readers requiring exploitation specifics should consult the Wordfence advisory for additional details.

Detection Methods for CVE-2025-8357

Indicators of Compromise

Unexpected file deletions within /wp-content/uploads/ subdirectories not initiated by site administrators
HTTP requests to admin.php or admin-ajax.php containing Media Library Assistant action parameters paired with file path arguments
Author-level accounts generating unusually high volumes of plugin requests
Missing media attachments referenced in published posts resulting in broken image links

Detection Strategies

Monitor WordPress audit logs for file deletion events originating from the Media Library Assistant plugin
Alert on Author-level or Contributor-level accounts invoking administrative plugin endpoints
Deploy file integrity monitoring on /wp-content/uploads/ to flag deletions outside normal media workflows
Review web server access logs for POST or GET requests targeting the _process_mla_download_file code path

Monitoring Recommendations

Enable WordPress security plugin logging for all authenticated user file operations
Correlate plugin version data against the vulnerable range (versions ≤ 3.27) across managed WordPress inventories
Track newly created Author-level accounts and audit their activity against media library endpoints

How to Mitigate CVE-2025-8357

Immediate Actions Required

Update the Media Library Assistant plugin to a version newer than 3.27 that includes the vendor fix referenced in the plugin changeset
Audit existing Author-level and higher accounts and remove unused or untrusted accounts
Back up the /wp-content/uploads/ directory before applying remediation
Review recent file deletion activity for signs of prior exploitation

Patch Information

The plugin vendor addressed the vulnerability in a release following version 3.27. Site administrators should upgrade to the latest version of Media Library Assistant through the WordPress plugin management interface. The vendor fix is documented in the WordPress plugin repository changeset.

Workarounds

Deactivate the Media Library Assistant plugin until the patched version can be deployed
Restrict Author-level account registration and limit role assignments to trusted users
Apply web application firewall rules that block requests targeting Media Library Assistant delete operations from non-administrator users
Enforce least-privilege access by downgrading unnecessary Author accounts to Contributor or Subscriber roles

bash

# Verify installed Media Library Assistant version via WP-CLI
wp plugin get media-library-assistant --field=version

# Update plugin to the latest patched release
wp plugin update media-library-assistant

# List users with Author role or higher for audit
wp user list --role=author --fields=ID,user_login,user_email,user_registered