Threat Entry Updated 2025-12-15

CVE-2025-14045 - Url Media Uploader Plugin

The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.

PLUGIN Url Media Uploader

CVE-2025-14045

MEDIUM CVSS 4.3 2025-12-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-06

CVE-2025-1662 - Url Media Uploader Plugin

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Url Media Uploader

CVE-2025-1662

MEDIUM CVSS 6.4 2025-02-28

Risk Score

Open Full Technical Breakdown