Cross-Site Request Forgery Vulnerability in Restrict File Access Plugin by WordPress

CVE-2025-7667

What is CVE-2025-7667?

The Restrict File Access plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit missing or flawed nonce validation on the 'restrict-file-access' page. This security flaw can permit attackers to delete arbitrary files from the server, potentially compromising the site's integrity by enabling remote code execution if critical files, like wp-config.php, are deleted. Attackers could execute this by tricking an administrator into clicking a malicious link.

References