CVE-2025-14938 is a vulnerability in the Listeo Core WordPress plugin by Purethemes that permits unauthenticated arbitrary media uploads through the 'listeo_core_handle_dropped_media' AJAX function. The root cause is missing authorization and capability checks on the file upload endpoint, enabling attackers to add files to the media library without authentication. While this does not directly allow code execution, it poses a risk by potentially enabling further attacks through malicious file uploads. The vulnerability affects all versions up to 2.0.27. No patch or official remediation level has been disclosed, and no known exploits have been reported.

The vulnerability allows unauthenticated attackers to upload arbitrary media files to the WordPress site's media library. This could lead to indirect impacts such as hosting malicious files or facilitating further attacks, but direct code execution is not possible according to the available data. The medium severity rating reflects the limited but notable risk posed by unauthorized file uploads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected AJAX endpoint or disabling the Listeo Core plugin if feasible. Monitoring for unauthorized file uploads may help detect exploitation attempts. Follow updates from Purethemes for any forthcoming patches or official mitigation instructions.