CVE-2025-8213
Published: 31 July 2025
Summary
CVE-2025-8213 is a high-severity Absolute Path Traversal (CWE-36) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 20.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the nscan_ajax_quarantine and nscan_quarantine_select functions. This affects all versions up to and including 3.2.5 and is tracked as CVE-2025-8213 with a CVSS 3.1 score of 7.2 and CWE-36.
Authenticated attackers who possess Administrator-level access or higher can exploit the flaw over the network to delete arbitrary files on the underlying server, including files outside the WordPress root directory. The attack requires no user interaction and can impact confidentiality, integrity, and availability.
Public references include the vulnerable code paths in ajax_hooks.php and tab_quarantine.php along with a subsequent changeset that addresses the issue, indicating an official plugin update is available for remediation.
EPSS for the vulnerability has remained flat at 0.0125 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23267
Vulnerability details
The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible…
more
for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.