CVE-2025-12835: 
WordPress vulnerability analysis and mitigation

CVE-2025-12835 is an arbitrary file deletion vulnerability in the WooMulti WordPress plugin (versions through 1.7) that allows any authenticated user — including those with subscriber-level access — to delete arbitrary files on the server. The vulnerability was publicly disclosed on November 11, 2025, and assigned a CVSS v3.1 base score of 7.3 (High) (WPScan, Red Hat CVE). The assigning organization is WPScan, and no patched version is currently known to exist (WPScan).

The root cause is improper validation of a user-supplied filename parameter in the plugin's AJAX file deletion handler, classified as CWE-73 (External Control of File Name or Path). An authenticated attacker can craft a POST request to wp-admin/admin-ajax.php using the gbwm_ajax action with ajaxFunction=DeleteFile, supplying a path-traversal sequence (e.g., .../../../target.php) in the filename parameter to delete files outside the intended directory (WPScan). The only precondition is a valid WordPress account at subscriber level or above; no administrative privileges are required. A public proof-of-concept using curl has been published by the original researcher, Khaled Alenazi (Nxploited) (WPScan).

Successful exploitation allows an authenticated attacker to delete arbitrary files accessible to the web server process, including critical WordPress core files, configuration files (e.g., wp-config.php), or plugin/theme files. Deletion of wp-config.php can trigger a WordPress reinstallation flow, potentially enabling a full site takeover. The vulnerability has high integrity and availability impact with no confidentiality impact, as it enables destruction of data and disruption of site functionality rather than data exfiltration (WPScan, Red Hat CVE).

A public proof-of-concept exploit is available via the WPScan vulnerability database, requiring only a valid subscriber-level session cookie (WPScan). The EPSS score is approximately 0.069%, indicating a low but non-zero probability of exploitation in the wild in the near term. No evidence of active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been identified at this time (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the WooMulti plugin (version ≤ 1.7) via passive enumeration, plugin fingerprinting, or tools like WPScan.
2. Obtain authentication: Register or use an existing low-privilege WordPress account (subscriber level or above) on the target site.
3. Identify target file: Determine the path of a critical file to delete relative to the WordPress root (e.g., wp-config.php, a plugin file, or a custom script).
4. Craft malicious request: Send a POST request to wp-admin/admin-ajax.php with the subscriber session cookie, using the gbwm_ajax action and DeleteFile function with a path-traversal payload in the filename parameter:

   curl -i -X POST "http://target.example.com/wp-admin/admin-ajax.php" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "Cookie: <subscriber_cookie>" \
     --data "action=gbwm_ajax&ajaxFunction=DeleteFile&filename=.../../../wp-config.php"

5. Achieve objective: Confirm the target file has been deleted. Deletion of wp-config.php may trigger a WordPress setup wizard, enabling site takeover (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with parameters action=gbwm_ajax and ajaxFunction=DeleteFile; presence of path-traversal sequences (e.g., ../, .../) in the filename parameter of such requests.
• Logs: Web server access logs showing repeated POST requests to admin-ajax.php from low-privilege user sessions; HTTP 200 responses to the above requests indicating successful file deletion.
• File System: Unexpected absence of critical WordPress files such as wp-config.php, core plugin files, or theme files; missing files that were previously present and not intentionally removed.
• Process/Application: WordPress triggering a fresh installation wizard (indicating wp-config.php deletion); site errors or broken functionality consistent with missing core files (WPScan).

No patched version of the WooMulti plugin is currently available (WPScan). The recommended immediate action is to deactivate and remove the WooMulti plugin until a fix is released. As a compensating control, administrators should restrict WordPress user registration, audit existing low-privilege accounts, and implement web application firewall (WAF) rules to block requests to admin-ajax.php containing path-traversal patterns in the filename parameter. File integrity monitoring should be enabled to detect unauthorized file deletions.

The vulnerability was discovered and responsibly disclosed by researcher Khaled Alenazi (Nxploited), who also provided the proof-of-concept exploit (WPScan). The issue was tracked and published by WPScan and subsequently referenced by ENISA's EUVD and INCIBE-CERT. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability aggregator listings.