Vulnerability DatabaseCVE-2025-7645

CVE-2025-7645:
WordPress vulnerability analysis and mitigation

Overview

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress contains a critical vulnerability (CVE-2025-7645) discovered on July 22, 2025. This vulnerability affects all versions up to and including 3.2.8, allowing unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation in the 'delete-file' field (Wordfence).

Technical details

The vulnerability is classified as a path traversal issue (CWE-22) that stems from improper limitation of a pathname to a restricted directory. The vulnerability has received a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

Impact

The vulnerability can lead to remote code execution when specific files (such as wp-config.php) are deleted. This occurs when an administrator deletes a submission, which can result in arbitrary file deletion on the server, potentially compromising the entire WordPress installation (Wordfence).

Mitigation and workarounds

The vulnerability was patched in version 3.2.9 released on July 20, 2025. Users are strongly advised to update to this version or later to protect against this security issue. If immediate updating is not possible, administrators should exercise caution when deleting form submissions (WordPress).