CVE-2025-6043: 
WordPress vulnerability analysis and mitigation

CVE-2025-6043 is an Arbitrary File Deletion vulnerability in the Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress, caused by a missing capability check on the wpmr_delete_file() function. It affects all plugin versions up to and including 17.0 (NVD) / 16.8 (ENISA/Wordfence), and is only exploitable when the plugin's advanced mode is enabled. The vulnerability was published on July 16, 2025, with Wordfence credited as the assigner. It carries a CVSS v3.1 base score of 8.1 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): the wpmr_delete_file() function in the plugin does not perform a capability check before executing file deletion operations, allowing any authenticated user — including those with only Subscriber-level access — to invoke it. An attacker can send a crafted authenticated HTTP request targeting this function to delete arbitrary files on the server's filesystem. By strategically deleting critical files (e.g., WordPress configuration files or .htaccess), an attacker can create conditions that enable remote code execution. Exploitation requires the plugin's advanced mode to be active on the target site (Wordfence, ENISA EUVD).

Successful exploitation allows authenticated attackers with minimal privileges (Subscriber-level or above) to delete arbitrary files on the WordPress server, directly impacting integrity and availability. Deletion of critical files such as wp-config.php can trigger WordPress reinstallation flows or expose database credentials, while deletion of .htaccess or other configuration files may enable remote code execution as a secondary consequence. The vulnerability does not directly expose confidential data (confidentiality impact is rated None), but the combination of file deletion and potential RCE poses a significant risk to the overall security posture of affected WordPress sites, estimated to number over 10,000 (Wordfence, Cyber Warriors ME).

1. Reconnaissance: Identify WordPress sites running the Malcure Malware Scanner plugin (versions ≤17.0) with advanced mode enabled, using tools like WPScan or by checking plugin metadata in publicly accessible readme.txt files.
2. Obtain Authentication: Register or obtain a low-privilege account (Subscriber-level or above) on the target WordPress site. Many sites allow open registration.
3. Identify the vulnerable function: Locate the wpmr_delete_file() function endpoint in the plugin, referencing the plugin source at wpmr.php (e.g., lines ~6304, ~6401, ~4570 in version 16.8).
4. Craft malicious request: Send an authenticated HTTP POST request to the WordPress AJAX handler (e.g., wp-admin/admin-ajax.php) with the appropriate action parameter targeting wpmr_delete_file() and specifying the path of the target file (e.g., wp-config.php or .htaccess).
5. Trigger file deletion: The missing capability check allows the request to proceed, deleting the specified file without authorization.
6. Achieve secondary objective: Depending on the deleted file, leverage the resulting broken state (e.g., WordPress reinstallation prompt after wp-config.php deletion) to achieve remote code execution or further compromise (Wordfence, ENISA EUVD).

• Network: Authenticated POST requests to wp-admin/admin-ajax.php with action parameters related to wpmr_delete_file from low-privilege user accounts; unusual file path parameters in AJAX requests.
• Logs: WordPress access logs showing repeated AJAX calls to file deletion endpoints from Subscriber-level accounts; PHP error logs indicating missing critical files (e.g., wp-config.php, .htaccess).
• File System: Unexpected absence of critical WordPress files such as wp-config.php, .htaccess, or core plugin/theme files; timestamps of file deletions correlating with suspicious login events.
• Process/Application: WordPress entering setup/reinstallation mode unexpectedly; site returning 500 errors or blank pages following file deletions (Wordfence).

Update the Malcure Malware Scanner plugin to a version beyond 16.8/17.0 (the patched release) as the primary remediation (ENISA EUVD, Wordfence). As an immediate workaround, disable advanced mode in the plugin settings, which removes the exploitable attack surface. Additionally, restrict user registration on the WordPress site to limit the pool of potential attackers, and monitor for unauthorized file deletion activity. Verify website file integrity after any suspected exploitation.

The vulnerability received coverage from multiple cybersecurity news outlets and community aggregators shortly after disclosure on July 16, 2025, with reports highlighting the risk to over 10,000 WordPress sites running the affected plugin (Cyber Warriors ME, The Cyber Express). Wordfence included it in their weekly WordPress vulnerability report for July 14–20, 2025 (Wordfence Blog). Social media activity was noted on Bluesky and Mastodon-based infosec communities. The vulnerability was also flagged in a Fortress SRM threat update for August 2025, indicating ongoing awareness in the security community.