CVE-2024-13897

Medium

Published: 06 March 2025

Published

06 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.1499 94.7th percentile

Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13897 is a medium-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page function. The flaw affects all versions up to and including 1.22 and is tracked as CWE-22 path traversal with a CVSS 3.1 score of 6.5.

Authenticated attackers holding Administrator privileges or higher can supply crafted input to delete arbitrary files on the underlying server. Successful exploitation can remove critical files such as wp-config.php and thereby enable remote code execution.

Public references include the vulnerable code path in the plugin repository, a changeset that addresses the issue in class-movingmedialibraryadmin.php, and the corresponding Wordfence advisory; administrators should apply the available patch or upgrade to a corrected release to eliminate the path-validation weakness.

EPSS remains flat at 0.1499 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-6112

Vulnerability details

The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page function in all versions up to, and including, 1.22. This makes it possible for authenticated attackers, with Administrator-level…

access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

Why these techniques?

Arbitrary file deletion via path traversal directly enables T1070.004 (File Deletion) and T1485 (Data Destruction), with potential for availability impact or RCE via critical file removal.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0