{"id":59683,"date":"2025-07-27T14:32:52","date_gmt":"2025-07-27T14:32:52","guid":{"rendered":""},"modified":"2025-08-31T21:18:39","modified_gmt":"2025-09-01T03:18:39","slug":"cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress\/","title":{"rendered":"<strong>CVE-2025-6043: Critical Arbitrary File Deletion Vulnerability in Malcure Malware Scanner for WordPress<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to execute arbitrary file deletion, making <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26074-remote-code-execution-vulnerability-in-orkes-conductor-v3-21-11\/\"  data-wpil-monitor-id=\"66283\">remote code execution<\/a> possible under certain circumstances.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-6043<br \/>\nSeverity: Critical (8.1\/10)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: Low (Subscriber-level access)<br \/>\nUser Interaction: Required<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7419-critical-vulnerability-discovered-in-tenda-o3v2-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"68917\">System compromise and potential<\/a> data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-49667678\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Malcure Malware Scanner <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5835-droip-plugin-for-wordpress-unauthorized-access-and-modification-vulnerability\/\"  data-wpil-monitor-id=\"70277\">Plugin for WordPress<\/a> | All versions up to and including 16.8<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The CVE-2025-6043 <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8322-critical-missing-authorization-vulnerability-in-e-school-software-by-ventem\/\"  data-wpil-monitor-id=\"70276\">vulnerability exploits a missing<\/a> capability check on the wpmr_delete_file() function within the Malcure Malware Scanner for WordPress. When a website has advanced mode enabled, an authenticated user with as little as subscriber-level access can trigger this function to delete <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7340-critical-arbitrary-file-upload-vulnerability-in-ht-contact-form-widget-for-wordpress\/\"  data-wpil-monitor-id=\"66341\">arbitrary files<\/a>. This could <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-41668-critical-file-replacement-leading-to-unauthorized-access\/\"  data-wpil-monitor-id=\"66282\">lead to the deletion of essential system files<\/a>, causing disruptions or making the system more susceptible to further attacks. In the worst-case scenario, this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52808-a-critical-php-remote-file-inclusion-vulnerability-in-realtyelite\/\"  data-wpil-monitor-id=\"65872\">vulnerability could be exploited for remote<\/a> code execution, potentially granting an attacker full control over the affected system.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2680232064\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>An example of how this vulnerability might be exploited is shown in the following pseudocode:<\/p>\n<pre><code class=\"\" data-line=\"\">POST \/wp-admin\/admin-ajax.php?action=wpmr_delete_file HTTP\/1.1\nHost: vulnerable-website.com\nContent-Type: application\/json\nCookie: wordpress_logged_in_[hash]=username|expiry|token|hash\n{ &quot;file&quot;: &quot;\/path\/to\/arbitrary\/file.php&quot; }<\/code><\/pre>\n<p>In the above example, the attacker sends a <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8243-critical-buffer-overflow-vulnerability-in-totolink-x15-http-post-request-handler\/\"  data-wpil-monitor-id=\"68918\">POST request<\/a> to the admin-ajax.php file with the action set to wpmr_delete_file. The attacker then specifies the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-9408-server-side-request-forgery-attack-in-eclipse-glassfish\/\"  data-wpil-monitor-id=\"77247\">file they want to delete<\/a> in the request body. Note that the attacker would need to be authenticated, hence the inclusion of the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6441-unauthenticated-login-token-generation-vulnerability-in-webinarignition-wordpress-plugin\/\"  data-wpil-monitor-id=\"68916\">WordPress login<\/a> cookie.<\/p>\n<p><strong>Mitigation<\/strong><\/p>\n<p>To mitigate this vulnerability, users are strongly advised to apply the vendor patch immediately. In case the patch cannot be applied right away, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary measure to prevent exploitation of the vulnerability. Moreover, disabling the advanced mode on the site can also reduce the risk.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59683","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=59683"}],"version-history":[{"count":6,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683\/revisions"}],"predecessor-version":[{"id":69615,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59683\/revisions\/69615"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=59683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=59683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=59683"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=59683"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=59683"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=59683"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=59683"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=59683"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=59683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}