CVE-2025-14938
Unauthenticated Arbitrary Media Upload in Listeo Core Plugin
Publication date: 2026-04-04
Last updated on: 2026-04-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| purethemes | listeo_core | to 2.0.27 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Listeo Core plugin for WordPress has a vulnerability in all versions up to and including 2.0.27 that allows unauthenticated attackers to upload arbitrary media files to the site's media library.
This occurs because the AJAX endpoint responsible for handling file uploads, specifically the "listeo_core_handle_dropped_media" function, lacks proper authorization and capability checks.
Although attackers can upload arbitrary media, this vulnerability does not allow them to directly execute code on the site.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to upload arbitrary media files to your WordPress site's media library.
While it does not provide direct code execution, the presence of unauthorized media files could lead to indirect impacts such as storage abuse, potential phishing or social engineering through malicious media, or further exploitation if combined with other vulnerabilities.
The CVSS score of 5.3 indicates a medium severity impact, primarily affecting the integrity of the site by allowing unauthorized content insertion.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Listeo Core plugin to a version later than 2.0.27, as all versions up to and including 2.0.27 are vulnerable.
After updating, clear your website's cache and hosting cache to ensure the update is fully applied.
Also, make sure to update related plugins such as Listeo Editor and Listeo Elementor to their latest versions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to upload arbitrary media files to the WordPress site's media library due to missing authorization checks.
While this does not lead to direct code execution, the ability to upload arbitrary media could potentially expose the site to risks related to data integrity and unauthorized content hosting.
However, there is no direct information provided about how this vulnerability impacts compliance with standards such as GDPR or HIPAA.