CVE-2025-14913: 
WordPress vulnerability analysis and mitigation

CVE-2025-14913 is a Missing Authorization vulnerability in the Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin for WordPress. The flaw exists in the media_delete_action function and allows unauthenticated remote attackers to delete arbitrary media attachments from affected WordPress sites. All plugin versions up to and including 1.2.6 are affected. The vulnerability was disclosed on December 25, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the media_delete_action AJAX handler in class-fpsml-ajax.php (line 91) performs an incorrect or insufficient authorization check, failing to verify that the requesting user has the necessary permissions to delete media attachments. Because the function is accessible without authentication, any remote actor can invoke it directly via an HTTP request. The vulnerable code is publicly visible in the WordPress plugin repository (WordPress Trac), and the fix was applied in changeset 3427082 (WordPress Changeset).

Successful exploitation allows an unauthenticated attacker to permanently delete arbitrary media attachments (images, documents, etc.) stored on the WordPress site, resulting in unauthorized data loss and potential disruption of site content. The integrity impact is limited to deletion of attachments — there is no confidentiality breach or direct availability impact to the WordPress service itself per the CVSS assessment. However, mass deletion of media assets could significantly degrade site functionality and user experience, and could be used as a targeted vandalism or sabotage vector against content-heavy WordPress sites (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-14913 as of the available data. The EPSS score is approximately 0.045%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low EPSS, the unauthenticated nature of the attack vector (no credentials or user interaction required) makes it trivially exploitable if targeted.

1. Reconnaissance: Identify WordPress sites running the Frontend Post Submission Manager Lite plugin (version ≤ 1.2.6) using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/frontend-post-submission-manager-lite/readme.txt.
2. Identify target attachment IDs: Browse the target WordPress site to collect media attachment IDs (e.g., from image URLs containing ?attachment_id= or from post source code referencing media files).
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint targeting the media_delete_action function, supplying the target attachment ID as a parameter (e.g., POST /wp-admin/admin-ajax.php with action=media_delete_action&attachment_id=<ID>).
4. Confirm deletion: Verify that the targeted attachment has been removed by attempting to access its URL or checking the WordPress media library. Repeat for additional attachment IDs to cause widespread content loss (WordPress Trac).

• Network: Unusual or repeated HTTP POST requests to /wp-admin/admin-ajax.php with action=media_delete_action from unauthenticated (no valid session cookie) or unknown IP addresses.
• Logs: WordPress access logs showing POST requests to admin-ajax.php with the media_delete_action parameter from IPs not associated with site administrators; high volume of such requests in a short timeframe.
• File System: Missing media files in the WordPress uploads directory (/wp-content/uploads/) that were previously present; orphaned database entries in the wp_posts table for attachments with no corresponding files.
• WordPress Admin: Unexplained disappearance of media attachments from the WordPress Media Library without corresponding admin user activity in audit logs.

The vendor (wpshuffle) released a patched version of the plugin addressing this vulnerability, as reflected in WordPress plugin changeset 3427082. Update the Frontend Post Submission Manager Lite plugin to a version later than 1.2.6 immediately (WordPress Changeset). As a temporary workaround if updating is not immediately possible, consider deactivating the plugin or using a Web Application Firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with the media_delete_action parameter. WordPress site administrators should also audit their media library for any unexplained missing attachments.