CVE-2025-7772: Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 16.8 via the wpmrinspectfile() function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal (plugin)to a version that resolves this vulnerability.Fixed in 16.8 - Compensating control
Restrict authenticated access to WordPress (especially Subscriber+ accounts) to reduce the risk of arbitrary file read via the vulnerable wpmr_inspect_file() function.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7772?
CVE-2025-7772 is considered to have medium severity due to its potential for exposing sensitive files.
How do I fix CVE-2025-7772?
To fix CVE-2025-7772, update the Malcure Malware Scanner plugin to version 16.9 or later.
Who is affected by CVE-2025-7772?
All versions of the Malcure Malware Scanner plugin for WordPress up to and including 16.8 are affected by CVE-2025-7772.
What is the impact of CVE-2025-7772?
CVE-2025-7772 allows authenticated users to read arbitrary files on the server, which could lead to sensitive data exposure.
When was CVE-2025-7772 disclosed?
CVE-2025-7772 was made public in 2025, following the identification of the vulnerability in the plugin.