CVE-2025-14045 is a missing authorization vulnerability (CWE-862) in the URL Media Uploader WordPress plugin by apprhyme. The issue arises because the url_media_uploader_url_upload_ajax_handler() function lacks a capability check, enabling authenticated users with Contributor-level permissions or higher to upload media files without proper authorization. This could lead to unauthorized file uploads, potentially affecting site integrity. The vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official fix has been documented yet.

The vulnerability allows authenticated users with Contributor-level access or higher to upload media files without proper authorization checks. This could lead to unauthorized content being added to the site, impacting the integrity of the site content. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor uploads for unauthorized content. Avoid granting Contributor or higher privileges to untrusted users. Follow vendor updates closely for any forthcoming patches or official mitigations.