CVE-2025-14045: Apprhyme Url Media Uploader

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.

Affected products

• Apprhyme Url Media Uploader: up to and including 1.0.1

Published 2025-12-12. Last modified 2026-10-07.