Vulnerabilities

TI-2025-12833 CVE-2025-14045 · GHSA-877f-6rrp-84p7

URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload

MEDIUM 53

The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and includ…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00283 Published 2025-12-12 No fix listed CWE-862

TI-2025-01428 CVE-2025-1662 · GHSA-qwj2-2fwc-g58h

URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding

LOW 28

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00286 Published 2025-02-28 No fix listed CWE-918

Vulnerabilities

Filters

URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload

URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding