What is the CVSS score of CVE-2025-14938?

CVE-2025-14938 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-14938

EUVD-2025-209219 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-04 Wordfence

GHSA-wf7g-5h8x-jvpp

WordPress File Upload RCE

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2025-209219

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.

AnalysisAI

Unauthenticated arbitrary media upload in Listeo Core plugin for WordPress (versions up to 2.0.27) allows remote attackers to upload arbitrary files to the site's media library via the unprotected listeo_core_handle_dropped_media AJAX endpoint. The vulnerability stems from missing authorization checks and does not directly enable code execution, but significantly degrades site integrity by enabling malicious file storage and potential downstream attacks.

Technical ContextAI

The vulnerability exists in the Listeo Core WordPress plugin, a directory listing theme/plugin developed by PureThemes. The affected AJAX endpoint listeo_core_handle_dropped_media processes file uploads without validating user capabilities or permissions. WordPress AJAX endpoints that lack proper nonce verification and capability checks (wp_verify_nonce and current_user_can) can be invoked by any unauthenticated visitor. The vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a classic file upload authorization flaw. The CPE identifies the vulnerable product as purethemes:listeo-core_-_directory_plugin_by_purethemes across all versions through 2.0.27.

RemediationAI

Site administrators must immediately upgrade the Listeo Core plugin to a patched version released after 2.0.27. The exact patched version number is not specified in the available references; administrators should check the PureThemes changelog and plugin repository for the latest stable release. Updates can be applied via the WordPress admin dashboard (Plugins > Installed Plugins > Listeo Core > Update if available). As a temporary workaround pending patching, site administrators may disable the plugin entirely or restrict AJAX request handling via Web Application Firewall (WAF) rules targeting the listeo_core_handle_dropped_media endpoint, though this may impact legitimate functionality. Administrators should also audit their media library for suspicious uploads made during the window of exposure. Detailed guidance is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/4decf597-1819-402f-ab28-2446a3e6215f.