CVE-2025-7643
Published: 18 July 2025
Summary
CVE-2025-7643 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion in all versions through 2.1.2. The flaw stems from insufficient file path validation in the handle_actions() function, which permits manipulation of file paths supplied to deletion operations. This is tracked as CVE-2025-7643 with a CVSS 3.1 score of 9.1 and is classified under CWE-22.
Unauthenticated attackers can exploit the issue over the network by sending crafted requests that cause the plugin to delete arbitrary files on the underlying server. Successful exploitation can remove critical files such as wp-config.php, which in turn enables remote code execution and full site compromise.
The referenced advisories from Wordfence and the plugin repository page identify the affected component and confirm the unauthenticated attack vector but do not detail specific patch contents or mitigation steps beyond version updates. The associated EPSS score has remained flat at 0.0940 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21852
Vulnerability details
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary…
more
files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of public-facing WordPress plugin via path traversal enables arbitrary file deletion (T1070.004) and matches the primary initial access vector for web application flaws (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the path traversal flaw in the Attachment Manager plugin's handle_actions() function to eliminate arbitrary file deletion capability.
Enforces information input validation at entry points like the plugin's handle_actions() to block path traversal payloads enabling arbitrary file deletions.
Monitors software and information integrity to identify unauthorized file deletions such as wp-config.php resulting from exploitation.