{"id":59683,"date":"2025-07-27T14:32:52","date_gmt":"2025-07-27T14:32:52","guid":{"rendered":""},"modified":"2025-08-31T21:18:39","modified_gmt":"2025-09-01T03:18:39","slug":"cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress\/","title":{"rendered":"<strong>CVE-2025-6043: Critical Arbitrary File Deletion Vulnerability in Malcure Malware Scanner for WordPress<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to execute arbitrary file deletion, making <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26074-remote-code-execution-vulnerability-in-orkes-conductor-v3-21-11\/\"  data-wpil-monitor-id=\"66283\">remote code execution<\/a> possible under certain circumstances.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-6043<br \/>\nSeverity: Critical (8.1\/10)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: Low (Subscriber-level access)<br \/>\nUser Interaction: Required<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7419-critical-vulnerability-discovered-in-tenda-o3v2-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"68917\">System compromise and potential<\/a> data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-3085615550\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 720px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 22px; font-weight: 600; display: flex; align-items: center; letter-spacing: -0.02em;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 10px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 42px; height: 42px;\" \/>\r\n    <\/a>\r\n    Share secrets securely\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 14px; color: #d1d5db;\">\r\n    Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 18px; color: #a1a1aa;\">\r\n    Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 24px; color: #e4e4e7;\">\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Encrypted identity<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Private Spaces for organizations and teams<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 End-to-end encrypted chat, calls, files, and notes<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Sensitive AI work and protected collaboration<\/li>\r\n    <li>\u2022 Built for information that cannot leak<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px; color: #ffffff;\">\r\n    Our mission is to secure human work alongside AI.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Download Ameeba\r\n    <\/a>\r\n\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Learn More\r\n    <\/a>\r\n  <\/div>\r\n<\/div><\/div>\n<p>Product | Affected Versions<\/p>\n<p>Malcure Malware Scanner <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5835-droip-plugin-for-wordpress-unauthorized-access-and-modification-vulnerability\/\"  data-wpil-monitor-id=\"70277\">Plugin for WordPress<\/a> | All versions up to and including 16.8<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The CVE-2025-6043 <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8322-critical-missing-authorization-vulnerability-in-e-school-software-by-ventem\/\"  data-wpil-monitor-id=\"70276\">vulnerability exploits a missing<\/a> capability check on the wpmr_delete_file() function within the Malcure Malware Scanner for WordPress. When a website has advanced mode enabled, an authenticated user with as little as subscriber-level access can trigger this function to delete <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7340-critical-arbitrary-file-upload-vulnerability-in-ht-contact-form-widget-for-wordpress\/\"  data-wpil-monitor-id=\"66341\">arbitrary files<\/a>. This could <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-41668-critical-file-replacement-leading-to-unauthorized-access\/\"  data-wpil-monitor-id=\"66282\">lead to the deletion of essential system files<\/a>, causing disruptions or making the system more susceptible to further attacks. In the worst-case scenario, this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52808-a-critical-php-remote-file-inclusion-vulnerability-in-realtyelite\/\"  data-wpil-monitor-id=\"65872\">vulnerability could be exploited for remote<\/a> code execution, potentially granting an attacker full control over the affected system.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2978923427\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>An example of how this vulnerability might be exploited is shown in the following pseudocode:<\/p>\n<pre><code class=\"\" data-line=\"\">POST \/wp-admin\/admin-ajax.php?action=wpmr_delete_file HTTP\/1.1\nHost: vulnerable-website.com\nContent-Type: application\/json\nCookie: wordpress_logged_in_[hash]=username|expiry|token|hash\n{ &quot;file&quot;: &quot;\/path\/to\/arbitrary\/file.php&quot; }<\/code><\/pre>\n<p>In the above example, the attacker sends a <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8243-critical-buffer-overflow-vulnerability-in-totolink-x15-http-post-request-handler\/\"  data-wpil-monitor-id=\"68918\">POST request<\/a> to the admin-ajax.php file with the action set to wpmr_delete_file. The attacker then specifies the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-9408-server-side-request-forgery-attack-in-eclipse-glassfish\/\"  data-wpil-monitor-id=\"77247\">file they want to delete<\/a> in the request body. Note that the attacker would need to be authenticated, hence the inclusion of the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6441-unauthenticated-login-token-generation-vulnerability-in-webinarignition-wordpress-plugin\/\"  data-wpil-monitor-id=\"68916\">WordPress login<\/a> cookie.<\/p>\n<p><strong>Mitigation<\/strong><\/p>\n<p>To mitigate this vulnerability, users are strongly advised to apply the vendor patch immediately. In case the patch cannot be applied right away, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary measure to prevent exploitation of the vulnerability. Moreover, disabling the advanced mode on the site can also reduce the risk.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59683","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=59683"}],"version-history":[{"count":6,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683\/revisions"}],"predecessor-version":[{"id":69615,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683\/revisions\/69615"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=59683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=59683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=59683"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=59683"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=59683"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=59683"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=59683"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=59683"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=59683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}