PT-2025-43588 · WordPress · Azure Storage For Wordpress

Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-10749

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Microsoft Azure Storage for WordPress plugin for WordPress versions up to and including 4.5.1

Description The software is susceptible to unauthorized arbitrary media deletion. This is a result of missing capability checks on the 'azure-storage-media-replace' AJAX action. Authenticated attackers with subscriber-level access or higher can delete arbitrary media files from the WordPress Media Library through the replace attachment parameter, provided they have access to the nonce, which is exposed to all authenticated users.

Recommendations Update Microsoft Azure Storage for WordPress plugin for WordPress to a version later than 4.5.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10749

Affected Products

Azure Storage For Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10749 · Security Note
• https://twitter.com/VulmonFeeds/status/1981691793415590128 · Twitter Post
• https://twitter.com/CVEnew/status/1981643759839302074 · Twitter Post
• https://plugins.trac.wordpress.org/browser/windows-azure-storage/tags/4.5.1/includes/class-windows-azure-replace-media.php#L346 · Note
• https://t.me/cveNotify/140138 · Telegram Post
• https://plugins.trac.wordpress.org/browser/windows-azure-storage/tags/4.5.1/includes/class-windows-azure-replace-media.php#L152 · Note
• https://t.me/CVEtracker/35646 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386127%40windows-azure-storage&new=3386127%40windows-azure-storage&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad?source=cve · Note