CVE-2025-10749
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2Description
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.
Analysis
Arbitrary media deletion in Microsoft Azure Storage for WordPress plugin versions up to 4.5.1 allows authenticated subscribers and above to delete any media files from the WordPress Media Library due to missing capability checks on the 'azure-storage-media-replace' AJAX action. The vulnerability requires access to a nonce that is exposed to all authenticated users, enabling low-privilege attackers to perform unauthorized file deletion with no user interaction required. No public exploit code has been identified at the time of analysis.
Technical Context
The vulnerability exists in the AJAX handler for the 'azure-storage-media-replace' action within the Microsoft Azure Storage plugin for WordPress. The root cause is classified under CWE-862 (Missing Authorization), where the plugin fails to validate user capabilities (WordPress permission levels) before processing the AJAX request. The plugin implements nonce verification for CSRF protection but does not check whether the authenticated user possesses the capability to delete attachments or perform media library operations. The affected code is located in the class-windows-azure-replace-media.php file, specifically in the media replacement and deletion logic that accepts the replace_attachment parameter. Since the nonce is exposed to all authenticated users via the WordPress frontend, any subscriber-level user can craft a request with a valid nonce to trigger arbitrary deletion of attachments belonging to other users or critical media assets.
Affected Products
The Microsoft Azure Storage for WordPress plugin (CPE not independently confirmed from references) is vulnerable in all versions up to and including 4.5.1. This plugin extends WordPress with Azure Blob Storage integration for media library management. The vulnerability affects any WordPress installation running the plugin at versions 4.5.1 or earlier. Additional details and the complete plugin repository reference are available via the WordPress plugin trac browser links provided in the Wordfence vulnerability intelligence report.
Remediation
Update the Microsoft Azure Storage for WordPress plugin to a patched version released after 4.5.1. WordPress administrators should navigate to the Plugins menu in their WordPress dashboard, locate the Azure Storage plugin, and apply the available update. The fix involves adding proper capability checks (such as 'delete_posts' or 'manage_options') to the 'azure-storage-media-replace' AJAX handler before processing file deletion requests. Sites unable to immediately patch should consider temporarily deactivating the plugin or restricting subscriber-level user roles to trusted users only. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad for detailed mitigation guidance and patch availability confirmation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today