Analysis Report · Folder Analysis cache/wp-user-frontend_4.2.4 → cache/wp-user-frontend_4.2.5 — CVE-2025-14047

Vulnerability Existed: yes
TRUE POSITIVE
Broken Access Control / Improper Authorization - CWE-639 - includes/Ajax/Frontend_Form_Ajax.php [130-166]

Old Code:
```php
foreach ( $attachments_to_delete as $attach_id ) {
    wp_delete_attachment( $attach_id, true );
}
```

Fixed Code:
```php
// Attachment deletion authorization check
$current_user_id = get_current_user_id();
$post_id_for_edit = isset( $_POST['post_id'] ) ? intval( wp_unslash( $_POST['post_id'] ) ) : 0;

foreach ( $attachments_to_delete as $attach_id ) {
    $attach_id = absint( $attach_id );

    if ( empty( $attach_id ) ) {
        continue;
    }

    $attachment = get_post( $attach_id );

    // Skip if attachment doesn't exist or is not an attachment
    if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
        continue;
    }

    // Authorization check: User must be the attachment author OR have delete_others_posts capability
    $is_owner = ( $current_user_id > 0 ) && ( (int) $attachment->post_author === $current_user_id );
    $can_delete_others = current_user_can( 'delete_others_posts' );

    if ( ! $is_owner && ! $can_delete_others ) {
        continue;
    }

    if ( $post_id_for_edit > 0 ) {
        $attachment_parent = (int) $attachment->post_parent;

        if ( $attachment_parent !== 0 && $attachment_parent !== $post_id_for_edit && ! $can_delete_others ) {
            continue;
        }
    }

    wp_delete_attachment( $attach_id, true );
}
```

Explanation:
The original code was vulnerable to an authorization bypass vulnerability (CWE-639: Authorization Through User-Controlled Key). The AJAX endpoint was deleting attachments without verifying that the current user had permission to delete them. An authenticated user could potentially delete attachments belonging to other users or posts by manipulating the `$attachments_to_delete` array, even if they didn't have the appropriate permissions.

The fix implements proper authorization checks before deletion:
1. Retrieves the current user ID and post context
2. Validates each attachment exists and is actually an attachment post type
3. Verifies the user is either the attachment's original author OR has the `delete_others_posts` capability
4. If a specific post context exists, ensures the attachment belongs to that post (unless user has admin capabilities)
5. Only proceeds with deletion if authorization checks pass

This prevents unauthorized users from deleting attachments they don't own or aren't associated with their posts.