Analysis Report · Folder Analysis cache/frontend-post-submission-manager-lite_1.2.6 → cache/frontend-post-submission-manager-lite_1.2.7 — CVE-2025-14913

Vulnerability Existed: yes
FALSE POSITIVE
Insufficient Authentication Verification - CWE-863 - includes/classes/class-fpsml-ajax.php Lines 92-100
[Old Code]
```php
$media_key = sanitize_text_field($_POST['media_key']);
$attachment_date = get_the_date("U", $media_id);
$attachment_code = md5($attachment_date);
if ($media_key != $attachment_code) {
    $response['status'] = 403;
    $response['messsage'] = esc_html__('Unauthorized access', 'frontend-post-submission-manager-lite');
}
```
[Fixed Code]
```php
$current_user_id = get_current_user_id();
$media_author_id = (int) get_post_field('post_author', $media_id);
if (empty($media_author_id)) {
    $response['status'] = 403;
    $response['message'] = esc_html__('Unauthorized deletion of the media.', 'frontend-post-submission-manager-lite');
    die(json_encode($response));
}
if ($media_author_id !== $current_user_id) {
    $response['status'] = 403;
    $response['message'] = esc_html__('Unauthorized deletion of the media.', 'frontend-post-submission-manager-lite');
    die(json_encode($response));
}
```
Explanation:
The original code relied on a weak authorization mechanism using an MD5 hash of the attachment date (`md5($attachment_date)`), which is predictable and not cryptographically secure. An attacker could easily calculate the correct hash for any given date and delete media they don't own. The fix implements proper authorization by verifying that the current user ID matches the media's author ID, ensuring only the media owner can delete their own attachments. Additionally, the fix adds `is_user_logged_in()` check to the initial condition, providing an additional layer of authentication.

---

Vulnerability Existed: yes
TRUE POSITIVE
Improper Resource Validation - CWE-99 - includes/classes/class-fpsml-ajax.php Lines 92-108
[Old Code]
```php
if ($this->admin_ajax_nonce_verify()) {
    $media_id = intval($_POST['media_id']);
    $media_key = sanitize_text_field($_POST['media_key']);
    $attachment_date = get_the_date("U", $media_id);
    $attachment_code = md5($attachment_date);
    if ($media_key != $attachment_code) {
        // authorization check
    } else {
        $media_delete_check = wp_delete_attachment($media_id, true);
```
[Fixed Code]
```php
if ($this->admin_ajax_nonce_verify() && is_user_logged_in()) {
    $media_id = intval($_POST['media_id']);
    $current_user_id = get_current_user_id();
    $media_author_id = (int) get_post_field('post_author', $media_id);
    if (empty($media_author_id)) {
        // error handling
    }
    if ($media_author_id !== $current_user_id) {
        // error handling
    }
    $media_delete_check = wp_delete_attachment($media_id, true);
```
Explanation:
The original code deleted media without properly validating that the attachment exists and belongs to the current user before attempting deletion. The fix adds explicit validation to check if the media author ID exists and matches the current user ID before proceeding with deletion. This prevents unauthorized deletion of media and potential access to non-existent or orphaned attachments. Early termination with `die()` on invalid authorization prevents further processing.