CVE-2025-14045

Name of the Vulnerable Software and Affected Versions URL Media Uploader versions prior to 1.0.2

Description The plugin contains a flaw allowing authenticated users with Contributor-level access or higher to upload safe media files without proper authorization. This occurs because the url media uploader url upload ajax handler() function fails to perform a necessary capability check.

Recommendations Update the plugin to a version newer than 1.0.1. As a temporary mitigation, restrict access to the url media uploader url upload ajax handler() function.