{"id":59683,"date":"2025-07-27T14:32:52","date_gmt":"2025-07-27T14:32:52","guid":{"rendered":""},"modified":"2025-08-31T21:18:39","modified_gmt":"2025-09-01T03:18:39","slug":"cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-6043-critical-arbitrary-file-deletion-vulnerability-in-malcure-malware-scanner-for-wordpress\/","title":{"rendered":"CVE-2025-6043: Critical Arbitrary File Deletion Vulnerability in Malcure Malware Scanner for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to execute arbitrary file deletion, making remote code execution<\/a> possible under certain circumstances.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-6043
\nSeverity: Critical (8.1\/10)
\nAttack Vector: Network
\nPrivileges Required: Low (Subscriber-level access)
\nUser Interaction: Required
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Malcure Malware Scanner Plugin for WordPress<\/a> | All versions up to and including 16.8<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The CVE-2025-6043 vulnerability exploits a missing<\/a> capability check on the wpmr_delete_file() function within the Malcure Malware Scanner for WordPress. When a website has advanced mode enabled, an authenticated user with as little as subscriber-level access can trigger this function to delete arbitrary files<\/a>. This could lead to the deletion of essential system files<\/a>, causing disruptions or making the system more susceptible to further attacks. In the worst-case scenario, this vulnerability could be exploited for remote<\/a> code execution, potentially granting an attacker full control over the affected system.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An example of how this vulnerability might be exploited is shown in the following pseudocode:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=wpmr_delete_file HTTP\/1.1\nHost: vulnerable-website.com\nContent-Type: application\/json\nCookie: wordpress_logged_in_[hash]=username|expiry|token|hash\n{ \"file\": \"\/path\/to\/arbitrary\/file.php\" }<\/code><\/pre>\n
In the above example, the attacker sends a POST request<\/a> to the admin-ajax.php file with the action set to wpmr_delete_file. The attacker then specifies the file they want to delete<\/a> in the request body. Note that the attacker would need to be authenticated, hence the inclusion of the WordPress login<\/a> cookie.<\/p>\n
Mitigation<\/strong><\/p>\n
To mitigate this vulnerability, users are strongly advised to apply the vendor patch immediately. In case the patch cannot be applied right away, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary measure to prevent exploitation of the vulnerability. Moreover, disabling the advanced mode on the site can also reduce the risk.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-6043 is a severe vulnerability identified in the Malcure Malware Scanner for WordPress. This security flaw leaves millions of websites built using the popular WordPress platform at the risk of unauthorized file deletion, potentially leading to system compromise or data leakage. The vulnerability is significant because it allows even low-level, authenticated users to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59683","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t