PT-2025-29899

CVE-2025-7712

·

Published

2025-07-16

·

Updated

2025-07-22

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Madara - Core plugin for WordPress versions prior to 2.2.3
Description The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp manga delete zip() function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are deleted.
Recommendations Update the Madara - Core plugin to version 2.2.3 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2025-7712
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com