What is the CVSS score of CVE-2025-10749?

CVE-2025-10749 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-10749

MEDIUM

Missing Authorization (CWE-862)

2025-10-24 security@wordfence.com

WordPress Microsoft Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 24, 2025 - 09:15 nvd

MEDIUM 5.4

DescriptionCVE.org

The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.

AnalysisAI

Arbitrary media deletion in Microsoft Azure Storage for WordPress plugin versions up to 4.5.1 allows authenticated subscribers and above to delete any media files from the WordPress Media Library due to missing capability checks on the 'azure-storage-media-replace' AJAX action. The vulnerability requires access to a nonce that is exposed to all authenticated users, enabling low-privilege attackers to perform unauthorized file deletion with no user interaction required. No public exploit code has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the AJAX handler for the 'azure-storage-media-replace' action within the Microsoft Azure Storage plugin for WordPress. The root cause is classified under CWE-862 (Missing Authorization), where the plugin fails to validate user capabilities (WordPress permission levels) before processing the AJAX request. The plugin implements nonce verification for CSRF protection but does not check whether the authenticated user possesses the capability to delete attachments or perform media library operations. The affected code is located in the class-windows-azure-replace-media.php file, specifically in the media replacement and deletion logic that accepts the replace_attachment parameter. Since the nonce is exposed to all authenticated users via the WordPress frontend, any subscriber-level user can craft a request with a valid nonce to trigger arbitrary deletion of attachments belonging to other users or critical media assets.

Affected ProductsAI

The Microsoft Azure Storage for WordPress plugin (CPE not independently confirmed from references) is vulnerable in all versions up to and including 4.5.1. This plugin extends WordPress with Azure Blob Storage integration for media library management. The vulnerability affects any WordPress installation running the plugin at versions 4.5.1 or earlier. Additional details and the complete plugin repository reference are available via the WordPress plugin trac browser links provided in the Wordfence vulnerability intelligence report.

RemediationAI

Update the Microsoft Azure Storage for WordPress plugin to a patched version released after 4.5.1. WordPress administrators should navigate to the Plugins menu in their WordPress dashboard, locate the Azure Storage plugin, and apply the available update. The fix involves adding proper capability checks (such as 'delete_posts' or 'manage_options') to the 'azure-storage-media-replace' AJAX handler before processing file deletion requests. Sites unable to immediately patch should consider temporarily deactivating the plugin or restricting subscriber-level user roles to trusted users only. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad for detailed mitigation guidance and patch availability confirmation.