CVE-2025-14804: 
WordPress vulnerability analysis and mitigation

CVE-2025-14804 is an arbitrary file deletion vulnerability in the Frontend File Manager Plugin for WordPress (plugin slug: nmedia-user-file-uploader) affecting all versions before 23.5. The flaw allows any authenticated user — including those with the low-privilege Subscriber role — to delete arbitrary files on the server by exploiting a missing path validation and ownership check. It was publicly disclosed on December 17, 2025, and assigned a CVSS v3.1 base score of 7.7 (High) (WPScan, Red Hat CVE).

The root cause is classified as CWE-73 (External Control of File Name or Path): the plugin's wpfm_save_file_data AJAX action accepts a filename parameter without sanitizing path-traversal sequences (e.g., ../../../../) or verifying that the referenced file belongs to the requesting user. An attacker intercepts the file-save request sent to /wp-admin/admin-ajax.php and substitutes a path-traversal payload in the uploaded_files[...][filename] field, pointing to any server-accessible file. When the delete action is subsequently triggered via the plugin's UI, the server deletes the attacker-specified file rather than the legitimately uploaded one. A verified proof-of-concept demonstrating deletion of wp-config.php was published by researchers Gregory Allegoet and Bakir Tučić (WPScan).

Successful exploitation allows a low-privilege authenticated attacker to delete any file readable by the web server process, including critical WordPress files such as wp-config.php (which contains database credentials), theme files, plugin files, or even system files if permissions allow. Deletion of wp-config.php can render the WordPress site non-functional and may force a reconfiguration that exposes database credentials. While the CVSS score reflects no direct confidentiality or availability impact in its vector, real-world exploitation can cause significant availability disruption and facilitate further compromise by removing security controls or forcing site reinstallation (WPScan, Red Hat CVE).

A public proof-of-concept is available via WPScan, demonstrating the full exploitation path using Burp Suite to intercept and modify requests. The vulnerability requires only a valid Subscriber-level account, making it accessible to any registered user on affected WordPress sites. The EPSS score is approximately 0.027% (low automated exploitation probability), and there is no current listing in the CISA KEV catalog. No threat actor attribution or confirmed in-the-wild exploitation campaigns have been reported as of the disclosure date (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Frontend File Manager Plugin (nmedia-user-file-uploader) in a version below 23.5. This can be done by checking the plugin's readme.txt at https://target.com/wp-content/plugins/nmedia-user-file-uploader/readme.txt or using WPScan.
2. Obtain low-privilege access: Register or log in as a Subscriber-level user on the target WordPress site.
3. Locate the upload page: Navigate to a page containing the [ffmwp] shortcode (e.g., https://target.com/ffmwp/), which renders the file upload interface accessible to authenticated users.
4. Upload a benign file: Upload any .png file using the upload form and intercept the resulting HTTP requests using Burp Suite.
5. Inject path-traversal payload: In the second POST request to /wp-admin/admin-ajax.php (action wpfm_save_file_data), modify the uploaded_files[...][filename] parameter to a path-traversal string pointing to the target file, e.g.:

   uploaded_files%5Btestpng-1763396556462%5D%5Bfilename%5D=../../../../wp-config.php

6. Trigger deletion: After the upload completes and the file appears in the interface, click the trash/delete icon. The server resolves the manipulated path and deletes the attacker-specified file (e.g., wp-config.php) instead of the uploaded file (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=wpfm_save_file_data containing URL-encoded path-traversal sequences (e.g., %2F..%2F, ../../../../) in the uploaded_files[...][filename] parameter.
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php from a low-privilege user account, particularly with anomalous filename values; PHP error logs indicating failed file operations on unexpected paths.
• File System: Unexpected disappearance of critical files such as wp-config.php, .htaccess, or plugin/theme files; presence of backup files (e.g., wp-config.php.bak) that were subsequently deleted.
• Process: Web server process (e.g., Apache, Nginx, PHP-FPM) performing unlink() operations on files outside the plugin's designated upload directory.

Update the Frontend File Manager Plugin to version 23.5 or later, which introduces proper path parameter validation and file ownership verification. Site administrators should audit their WordPress user base for unexpected Subscriber-level accounts and review server file integrity for any missing critical files. If immediate upgrade is not possible, consider disabling the plugin or restricting access to pages containing the [ffmwp] shortcode to trusted user roles only (WPScan).

The vulnerability was covered by The Hacker Wire on social media platforms including Mastodon and Bluesky shortly after disclosure. Wordfence included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Blog). No major vendor statements beyond the WPScan advisory have been issued.