Arbitrary File Read Vulnerability in Malcure Malware Scanner for WordPress
CVE-2025-7772

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Malcure Malware Scanner — #1 Toolset For Malware Removal
Vendor
CVE Published:
18 July 2025

What is CVE-2025-7772?

The Malcure Malware Scanner plugin for WordPress allows authenticated users with subscriber-level access to exploit an Arbitrary File Read vulnerability. This arises from a lack of capability validation in the wpmr_inspect_file() function, enabling attackers to access sensitive files on the server. As a result, they can potentially expose confidential information, posing significant risks to website security. Users of all versions up to and including 16.8 should act promptly to secure their installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Malcure Malware Scanner — #1 Toolset for Malware Removal * <= 16.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Hydzik
JSON
.