CVE-2025-14629 is a missing authorization vulnerability in the Alchemist Ajax Upload WordPress plugin (versions up to 1.1). The plugin's 'delete_file' function lacks proper capability checks, enabling unauthenticated users to delete arbitrary media attachments. This vulnerability is classified under CWE-862 and has a CVSS 3.1 score of 5.3 (medium severity). No patch or vendor advisory is available, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

An attacker without any authentication can delete arbitrary media files from the WordPress media library, potentially causing data loss or disruption of website content that relies on these media assets. There is no indication of confidentiality or availability impact beyond the deletion of media files. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the Alchemist Ajax Upload plugin if it is not essential. Monitoring plugin updates from the vendor is recommended to apply any forthcoming patches promptly.