Arbitrary File Read Vulnerability in Malcure Malware Scanner for WordPress
CVE-2025-7772
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 July 2025
What is CVE-2025-7772?
The Malcure Malware Scanner plugin for WordPress allows authenticated users with subscriber-level access to exploit an Arbitrary File Read vulnerability. This arises from a lack of capability validation in the wpmr_inspect_file() function, enabling attackers to access sensitive files on the server. As a result, they can potentially expose confidential information, posing significant risks to website security. Users of all versions up to and including 16.8 should act promptly to secure their installations.
Affected Version(s)
Malcure Malware Scanner — #1 Toolset for Malware Removal * <= 16.8