What the vulnerability does
01Description
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.
Explanation of Vulnerability in Simple Terms
02Summary
The Microsoft Azure Storage for WordPress plugin through version 4.5.1 lacks proper authorization checks, allowing authenticated users with low privileges to modify or delete data they should not have access to. An attacker with a basic WordPress account can alter site content or disrupt availability without elevated permissions. Update to a version newer than 4.5.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify or delete WordPress data and files without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter or remove site content, media, or Azure storage configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
October 24, 2025
CVE published
April 8, 2026
Record updated
