CVE-2025-14938: 
WordPress vulnerability analysis and mitigation

CVE-2025-14938 is an unauthenticated arbitrary media upload vulnerability in the Listeo Core plugin for WordPress, affecting all versions up to and including 2.0.27. The flaw resides in the listeo_core_handle_dropped_media function, which exposes an AJAX endpoint for file uploads without any authorization or capability checks. It was published on April 4, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), stemming from missing authorization and capability checks on the WordPress AJAX endpoint that handles media file uploads. Any unauthenticated remote attacker can send a crafted HTTP POST request to the listeo_core_handle_dropped_media AJAX action, bypassing all access controls and depositing arbitrary media files directly into the site's WordPress media library. No authentication, privileges, or user interaction are required for exploitation. While the vulnerability does not directly enable code execution, it allows unrestricted file placement in the media library (GitHub Advisory, Wordfence).

Successful exploitation allows unauthenticated attackers to upload arbitrary media files to the WordPress site's media library, posing risks of website defacement, injection of malicious content (e.g., phishing pages or malicious scripts served from a trusted domain), and storage exhaustion attacks. While direct remote code execution is not achievable through this vulnerability alone, uploaded files could serve as a stepping stone for further attacks if combined with other vulnerabilities or misconfigurations. The integrity of the site's media library is directly compromised, with no confidentiality or availability impact in isolation (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.063% (0.041% per GitHub Advisory), placing it in the 13th percentile for exploitation likelihood within the next 30 days (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Listeo Core plugin version 2.0.27 or earlier using tools like WPScan, Shodan, or by inspecting plugin metadata exposed in page source or /wp-content/plugins/listeo-core/ paths.
2. Identify the vulnerable AJAX endpoint: Locate the WordPress AJAX handler for listeo_core_handle_dropped_media, typically accessible via wp-admin/admin-ajax.php?action=listeo_core_handle_dropped_media.
3. Craft the upload request: Prepare a multipart HTTP POST request targeting the AJAX endpoint with an arbitrary media file (e.g., an HTML file, SVG with embedded script, or other content) as the file payload. No authentication cookies or nonces are required due to missing authorization checks.
4. Submit the request: Send the crafted POST request to https://[target]/wp-admin/admin-ajax.php with action=listeo_core_handle_dropped_media and the file attached. The server processes and stores the file in the WordPress media library without validation.
5. Leverage the upload: Access the uploaded file via its public URL in the media library to serve malicious content, conduct phishing, or attempt further exploitation in combination with other vulnerabilities (GitHub Advisory, Wordfence).

• Network: Unexpected or high-volume POST requests to wp-admin/admin-ajax.php with the parameter action=listeo_core_handle_dropped_media from unauthenticated (no session cookie) sources; unusual file upload traffic from unknown or foreign IP addresses.
• Logs: Web server access logs showing POST requests to /wp-admin/admin-ajax.php?action=listeo_core_handle_dropped_media without valid authentication headers or WordPress nonces; repeated upload attempts from the same IP.
• File System: Unexpected or suspicious files (e.g., .html, .svg, .php, or other non-standard media types) appearing in the WordPress wp-content/uploads/ directory without corresponding legitimate user activity.
• WordPress Media Library: Presence of files in the media library with no associated author/user, or files with suspicious names, content types, or upload timestamps outside of normal business hours.

Organizations should upgrade the Listeo Core plugin to a version newer than 2.0.27, which contains the fix for this vulnerability (Wordfence, PureThemes Changelog). If immediate patching is not possible, implement Web Application Firewall (WAF) rules to block unauthenticated POST requests to the listeo_core_handle_dropped_media AJAX action. Additionally, audit the WordPress media library for any unauthorized or suspicious uploads, and consider temporarily disabling the plugin if it is not actively in use. Restricting access to wp-admin/admin-ajax.php for unauthenticated users at the server or WAF level can also reduce exposure.

The vulnerability was discovered and reported by Wordfence, which published the advisory on April 4, 2026 (Wordfence). No significant broader media coverage, notable researcher commentary, or social media discussion beyond automated CVE tracking feeds has been identified for this vulnerability.