CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments.
Explanation of Vulnerability in Simple Terms
Alchemist Ajax Upload versions 1.1 and earlier lack proper authorization checks on file upload functionality. An attacker can upload files to the affected system without authentication. The vulnerability allows modification of site content through unauthorized file uploads, though it does not expose sensitive data or cause service disruption.
What an attacker can do
Upload files to the site without logging in or having permission to do so.
Potential impact on your site
Attackers can upload malicious files, potentially replacing legitimate content or injecting code into your site.
Conditions required to exploit
Network access to the upload endpoint; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
