CVE-2025-7643: Attachment Manager <= 2.1.2 - Unauthenticated Arbitrary File Deletion
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleactions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Attachment Manager pluginto a version that resolves this vulnerability.Fixed in 2.1.2 - Compensating control
Mitigate unauthenticated arbitrary file deletion by restricting access to the WordPress endpoints that trigger Attachment Manager actions (e.g., block unauthenticated requests to the relevant Attachment Manager AJAX/handler routes at the web server/WAF/ACL) until the plugin is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7643?
The severity of CVE-2025-7643 is considered high due to the potential for unauthenticated attackers to delete arbitrary files.
How do I fix CVE-2025-7643?
To fix CVE-2025-7643, users should immediately update the WordPress Attachment Manager plugin to version 2.1.3 or later.
What versions are affected by CVE-2025-7643?
CVE-2025-7643 affects all versions of the WordPress Attachment Manager plugin up to and including version 2.1.2.
Who is at risk with CVE-2025-7643?
All users of the WordPress Attachment Manager plugin version 2.1.2 or earlier are at risk from CVE-2025-7643.
What types of attacks can be performed due to CVE-2025-7643?
CVE-2025-7643 allows unauthenticated attackers to perform arbitrary file deletion attacks.