CVE-2025-6043
Published: 16 July 2025
Summary
CVE-2025-6043 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
The Malcure Malware Scanner plugin for WordPress is affected by an arbitrary file deletion vulnerability (CVE-2025-6043) stemming from a missing capability check in the wpmr_delete_file() function. The flaw impacts all versions through 17.0 and is present in the plugin's core file-handling logic, as referenced in the WordPress plugin repository traces.
Authenticated attackers holding Subscriber-level privileges or higher can exploit the issue when advanced mode is enabled on the target site. Successful exploitation permits deletion of arbitrary files on the server, which in turn enables remote code execution by removing or overwriting critical components such as configuration or executable files.
The associated EPSS score remains flat at a low 0.0196 with no material increase after disclosure. Public references, including Wordfence threat intelligence and direct links to the vulnerable code paths, confirm the missing authorization check but do not detail specific patch timelines or mitigation steps beyond standard plugin update practices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21581
Vulnerability details
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmr_delete_file() function in all versions up to, and including, 17.0. This makes…
more
it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code execution possible. This is only exploitable when advanced mode is enabled on the site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization enables low-priv authenticated deletion of arbitrary server files, directly mapping to file deletion for impact or indicator removal and data destruction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the missing capability check in the wpmr_delete_file() function that allows arbitrary file deletion.
AC-6 implements least privilege to restrict Subscriber-level users from accessing file deletion functions, preventing low-privileged exploitation.
SI-2 requires identification, reporting, and correction of system flaws like the missing authorization in the plugin, preventing exploitation through patching.