Arbitrary File Deletion Vulnerability in Malcure Malware Scanner Plugin for WordPress
CVE-2025-6043

8.1HIGH

Key Information:

Vendor

WordPress
Status
Malcure Malware Scanner — #1 Toolset For WordPress Malware Removal
Vendor
CVE Published:
16 July 2025

What is CVE-2025-6043?

The Malcure Malware Scanner plugin for WordPress is susceptible to an Arbitrary File Deletion vulnerability, allowing authenticated users with Subscriber-level access or higher to delete files from the server. This issue arises from a missing capability check in the wpmr_delete_file() function across all versions up to 16.8. If advanced mode is enabled on the site, this vulnerability can lead to remote code execution, putting the site at substantial risk. Website administrators are strongly advised to update to the latest version and review their permissions settings to enhance security.

Affected Version(s)

Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal * <= 16.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-malware-rem...
https://plugins.trac.wordpress.org/browser/wp-malware-rem...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Hydzik
.
CVE-2025-6043 : Arbitrary File Deletion Vulnerability in Malcure Malware Scanner Plugin for WordPress