Cross-Site Request Forgery Vulnerability in Restrict File Access Plugin by WordPress
CVE-2025-7667
8.1HIGH
What is CVE-2025-7667?
The Restrict File Access plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit missing or flawed nonce validation on the 'restrict-file-access' page. This security flaw can permit attackers to delete arbitrary files from the server, potentially compromising the site's integrity by enabling remote code execution if critical files, like wp-config.php, are deleted. Attackers could execute this by tricking an administrator into clicking a malicious link.
Affected Version(s)
Restrict File Access * <= 1.1.2
References
CVSS V3.1
Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Johannes Skamletz