CVE-2025-6043: Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmrdeletefile() function in all versions up to, and including, 17.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code execution possible. This is only exploitable when advanced mode is enabled on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6043?
CVE-2025-6043 has a high severity rating due to the potential for arbitrary file deletion.
How do I fix CVE-2025-6043?
To fix CVE-2025-6043, update the Malcure Malware Scanner plugin to a version later than 16.8 where the vulnerability is addressed.
Who is affected by CVE-2025-6043?
Users of the Malcure Malware Scanner plugin for WordPress running versions up to and including 16.8 are affected by CVE-2025-6043.
What kind of attack can exploit CVE-2025-6043?
CVE-2025-6043 can be exploited to perform arbitrary file deletion, potentially leading to data loss or site compromise.
Is authentication required to exploit CVE-2025-6043?
Yes, authentication is required to exploit CVE-2025-6043, as it affects authenticated users of the plugin.