CVE-2025-13419: 
WordPress vulnerability analysis and mitigation

CVE-2025-13419 is a Missing Authorization vulnerability in the "Guest posting / Frontend Posting / Front Editor – WP Front User Submit" WordPress plugin that allows unauthenticated attackers to delete arbitrary media attachments. It affects all versions of the plugin up to and including 5.0.0. The vulnerability was disclosed on January 7, 2026, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the /wp-json/bfe/v1/revert REST API endpoint exposed by the WP Front User Submit plugin. Because no authentication or authorization validation is performed on this endpoint, any unauthenticated network attacker can send a crafted HTTP request to trigger the deletion of arbitrary media attachments stored on the WordPress site. No special privileges, user interaction, or complex conditions are required for exploitation (Wordfence, WordPress Plugin Changeset).

Successful exploitation allows an unauthenticated remote attacker to permanently delete arbitrary media attachments (images, documents, etc.) from any WordPress site running the affected plugin version. This results in an integrity impact — content destruction — that could deface or disrupt the affected website's media library. There is no confidentiality or availability impact beyond the loss of media content, and lateral movement potential is limited (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the "WP Front User Submit" plugin (versions ≤ 5.0.0) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at https://target.com/wp-content/plugins/front-editor/.
2. Identify the vulnerable endpoint: Confirm the REST API endpoint /wp-json/bfe/v1/revert is accessible on the target site by sending a GET or OPTIONS request.
3. Enumerate media attachment IDs: Use the WordPress REST API (/wp-json/wp/v2/media) to list publicly accessible media attachment IDs on the target site.
4. Send deletion request: Craft and send an unauthenticated HTTP POST (or DELETE) request to /wp-json/bfe/v1/revert with the target media attachment ID as a parameter, bypassing any authorization check.
5. Confirm deletion: Verify the media attachment has been removed by checking the WordPress media library or attempting to access the previously known media URL (Wordfence).

• Network: Unauthenticated HTTP POST requests to /wp-json/bfe/v1/revert from external IP addresses in web server access logs; repeated requests to this endpoint from a single IP in a short timeframe.
• Logs: WordPress debug or access logs showing REST API calls to /wp-json/bfe/v1/revert without associated authenticated user sessions; HTTP 200 responses to these requests indicating successful execution.
• File System: Unexpected disappearance of media files from the WordPress uploads directory (wp-content/uploads/) without corresponding admin activity in the WordPress dashboard audit log.

Users should update the "WP Front User Submit" plugin to a version beyond 5.0.0 that includes the capability check fix, as referenced in the official plugin changeset (WordPress Plugin Changeset). As a temporary workaround, site administrators can disable the plugin until a patched version is applied, or use a web application firewall (WAF) rule to block unauthenticated requests to the /wp-json/bfe/v1/revert endpoint. Wordfence users with active firewall rules may have additional protection against exploitation of this endpoint (Wordfence).