Overview
The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to execute arbitrary file deletion, making remote code execution possible under certain circumstances.
Vulnerability Summary
CVE ID: CVE-2025-6043
Severity: Critical (8.1/10)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access)
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Malcure Malware Scanner Plugin for WordPress | All versions up to and including 16.8
How the Exploit Works
The CVE-2025-6043 vulnerability exploits a missing capability check on the wpmr_delete_file() function within the Malcure Malware Scanner for WordPress. When a website has advanced mode enabled, an authenticated user with as little as subscriber-level access can trigger this function to delete arbitrary files. This could lead to the deletion of essential system files, causing disruptions or making the system more susceptible to further attacks. In the worst-case scenario, this vulnerability could be exploited for remote code execution, potentially granting an attacker full control over the affected system.
Conceptual Example Code
An example of how this vulnerability might be exploited is shown in the following pseudocode:
POST /wp-admin/admin-ajax.php?action=wpmr_delete_file HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/json
Cookie: wordpress_logged_in_[hash]=username|expiry|token|hash
{ "file": "/path/to/arbitrary/file.php" }In the above example, the attacker sends a POST request to the admin-ajax.php file with the action set to wpmr_delete_file. The attacker then specifies the file they want to delete in the request body. Note that the attacker would need to be authenticated, hence the inclusion of the WordPress login cookie.
Mitigation
To mitigate this vulnerability, users are strongly advised to apply the vendor patch immediately. In case the patch cannot be applied right away, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary measure to prevent exploitation of the vulnerability. Moreover, disabling the advanced mode on the site can also reduce the risk.