PT-2025-51079 · WordPress · Mediacommander

Athiwat Tiprasaharn · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-14508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress versions prior to 2.3.2

Description The MediaCommander plugin for WordPress is susceptible to unauthorized data deletion. This occurs because of a missing capability check on the import-csv API endpoint. The endpoint incorrectly uses the upload files capability check (Author level) for an operation that can delete all folders. Authenticated attackers with Author-level access or higher can delete folder organization data created by Administrators and other users. The vulnerable API endpoint is /import-csv.

Recommendations Versions prior to 2.3.2 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14508

Affected Products

Mediacommander

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14508 · Security Note
• https://plugins.trac.wordpress.org/browser/mediacommander/trunk/includes/Rest/Controllers/FoldersController.php#L127 · Note
• https://twitter.com/CVEnew/status/1999865351635665167 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9102fe7e-7baa-4bc0-879f-cc7df1ea13d2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/mediacommander/trunk/includes/Models/FoldersModel.php#L793 · Note
• https://plugins.trac.wordpress.org/changeset/3417928 · Note