CVE-2025-7667: 
WordPress vulnerability analysis and mitigation

CVE-2025-7647 is a Cross-Site Request Forgery (CSRF) vulnerability in the Restrict File Access plugin for WordPress, affecting all versions up to and including 1.1.2. The flaw stems from missing or incorrect nonce validation on the restrict-file-access admin page, enabling unauthenticated attackers to delete arbitrary files on the server by tricking a site administrator into clicking a malicious link. Deletion of critical files such as wp-config.php can lead to remote code execution. It was published on July 15, 2025, with a CVSS v3.1 base score of 8.1 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and arises because the plugin's admin page (restrict-file-access) does not properly validate WordPress nonces before processing file deletion requests (Wordfence). An attacker crafts a forged HTTP request targeting the vulnerable endpoint and socially engineers a logged-in administrator into triggering it — for example, by embedding the request in a malicious link or page. No authentication or elevated privileges are required on the attacker's side; only user interaction from an administrator is needed. The vulnerable code path is visible in the plugin source at admin/admin.php#L78 (EUVD).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the WordPress server, with no direct confidentiality impact but high integrity and availability impact (CVSS I:H, A:H). The most severe scenario involves deleting wp-config.php, which can trigger WordPress's installation wizard and allow an attacker to reconfigure the database connection, effectively achieving remote code execution and full site takeover. This could also result in data loss, service disruption, and potential lateral movement within the hosting environment (Wordfence, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.135%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering of an administrator, which raises the practical bar, though the low attack complexity and lack of required privileges keep the overall risk elevated for sites running the affected plugin versions.

1. Reconnaissance: Identify WordPress sites using the Restrict File Access plugin (versions ≤ 1.1.2) via passive scanning, plugin enumeration tools, or public WordPress plugin directories.
2. Craft malicious request: Construct a forged HTTP POST or GET request targeting the restrict-file-access admin page that triggers a file deletion action (e.g., targeting wp-config.php or other critical files), exploiting the absent nonce validation.
3. Deliver the payload: Embed the forged request in a malicious link, image tag, or hidden form on an attacker-controlled page, or send it directly via email/phishing to a site administrator.
4. Trigger execution: Trick the authenticated site administrator into visiting the malicious page or clicking the link while logged into the WordPress admin panel, causing their browser to submit the forged request with their session credentials.
5. Achieve objective: The server processes the unauthenticated file deletion request. If wp-config.php is deleted, the attacker can navigate to the WordPress installation wizard to reconfigure the site and gain full administrative control, leading to remote code execution (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to the restrict-file-access admin page from unusual referrers or external origins; repeated file deletion events in WordPress audit logs.
• File System: Absence of wp-config.php or other critical WordPress core/configuration files; unexpected removal of plugin or theme files; new or modified wp-config.php indicating re-installation.
• Network: Requests to the WordPress admin panel originating from unexpected IP addresses or referrer headers pointing to external/unknown domains.
• Process: Unexpected WordPress installation wizard activity (/wp-admin/setup-config.php or /wp-admin/install.php being accessed) following file deletion events.

Site administrators should immediately update the Restrict File Access plugin to a version beyond 1.1.2, which includes proper nonce validation on the affected admin page (Wordfence). As interim mitigations, deploy a Web Application Firewall (WAF) with CSRF protection rules, restrict access to the WordPress admin panel by IP allowlisting, and educate administrators to avoid clicking links from untrusted sources. Regularly backing up the WordPress site and critical configuration files (especially wp-config.php) is strongly recommended to enable rapid recovery in the event of exploitation.

Wordfence, the CVE assigner, published the vulnerability as part of their weekly WordPress vulnerability report for July 14–20, 2025, highlighting the file deletion-to-RCE escalation path as a significant risk (Wordfence Weekly Report). Qualys included detection for this CVE (detection ID 530299) in their July 2025 web application detections update (Qualys). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator reporting has been observed.