CVE-2025-6043: Malcure Malware Scanner RCE Vulnerability

CVE-2025-6043 Overview

CVE-2025-6043 affects the Malcure Malware Scanner WordPress plugin, marketed as the "#1 Toolset for WordPress Malware Removal." The flaw resides in the wpmr_delete_file() function, which lacks a proper capability check. Authenticated users holding Subscriber-level access or higher can delete arbitrary files on the underlying server. Deleting key files such as wp-config.php can force WordPress into setup mode, enabling an attacker to connect the site to a database under their control and achieve remote code execution. The vulnerability impacts all plugin versions up to and including 17.0 and is only exploitable when the plugin's advanced mode is enabled. The weakness is tracked as a Missing Authorization issue [CWE-862].

Critical Impact
Subscriber-level attackers can delete arbitrary files on vulnerable WordPress installations, leading to potential remote code execution when advanced mode is enabled.

Affected Products

Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress
All versions up to and including 17.0
Sites where the plugin's advanced mode is enabled

Discovery Timeline

2025-07-16 - CVE-2025-6043 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6043

Vulnerability Analysis

The Malcure Malware Scanner plugin exposes a file deletion handler named wpmr_delete_file() that is reachable by authenticated users via the WordPress AJAX layer. The function performs the file removal operation without verifying that the calling user possesses an administrative capability such as manage_options. As a result, any authenticated account, including the lowest-privileged Subscriber role, can invoke the handler and remove arbitrary files from the WordPress installation directory or any path the PHP process can write to.

Deleting wp-config.php is the most direct path to remote code execution. When WordPress cannot locate its configuration file, it serves the setup wizard. An attacker who can reach the wizard can point the installation at an attacker-controlled database, create a new administrator account, and execute arbitrary PHP through theme or plugin editing functionality.

Root Cause

The root cause is a missing authorization check inside the file deletion handler. The plugin registers the AJAX action for both privileged and unprivileged-but-authenticated callers without gating it behind a current_user_can() check or a properly scoped nonce verification. This violates the principle of least privilege expressed by [CWE-862] Missing Authorization. The relevant code locations are documented in the WordPress Plugin Code Review and additional references at line 6304 and line 6401.

Attack Vector

Exploitation requires network access to the target site and any authenticated WordPress account, which on sites permitting open registration is trivial to obtain. The attacker submits an AJAX request to the vulnerable wpmr_delete_file() endpoint, supplying a target file path. After deleting wp-config.php or another sensitive file, the attacker triggers the WordPress installer flow to pivot toward administrative access. The attack succeeds only when the plugin's advanced mode is enabled on the target site. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6043

Indicators of Compromise

Unexpected POST requests to admin-ajax.php referencing the wpmr_delete_file action from low-privilege user sessions.
Missing or recently deleted wp-config.php, .htaccess, or core PHP files within the WordPress installation.
Sudden appearance of the WordPress setup wizard (/wp-admin/setup-config.php) on a previously configured site.
Newly created administrator accounts with no corresponding audit trail in legitimate admin activity.

Detection Strategies

Audit WordPress access logs for admin-ajax.php requests carrying the action=wpmr_delete_file parameter and correlate them with the originating user role.
Monitor file integrity on WordPress installations, focusing on wp-config.php and files under wp-content/plugins/wp-malware-removal/.
Review WordPress user role assignments and registration logs for anomalous Subscriber account creation followed by AJAX activity.

Monitoring Recommendations

Enable web application firewall logging for all authenticated AJAX traffic and alert on file path parameters traversing outside the upload directory.
Send WordPress and web server logs to a centralized SIEM or data lake for correlation across user activity, file changes, and HTTP errors.
Track plugin version inventory across hosted WordPress sites to identify instances still running Malcure Malware Scanner 17.0 or earlier.

How to Mitigate CVE-2025-6043

Immediate Actions Required

Update the Malcure Malware Scanner plugin to a version later than 17.0 as soon as the vendor publishes a fixed release.
If no patched version is available, disable the plugin's advanced mode, which is the precondition for exploitation.
Restrict new user registration or set the default role to a value that aligns with site policy and review existing Subscriber accounts.
Verify the integrity of wp-config.php and other core files; restore from backup if tampering is detected.

Patch Information

At the time of publication, the NVD entry references plugin code paths in version 16.8 and notes that all versions up to and including 17.0 are vulnerable. Site operators should consult the Wordfence Vulnerability Report for the latest fixed version information and apply the vendor patch through the WordPress plugin update channel once released.

Workarounds

Deactivate and remove the Malcure Malware Scanner plugin until a patched version is installed.
Disable advanced mode in the plugin settings to break the exploitation precondition.
Apply a web application firewall rule that blocks unauthenticated and Subscriber-level requests carrying the wpmr_delete_file AJAX action.
Set filesystem permissions so that the PHP process cannot delete wp-config.php or other critical files outside expected write paths.

bash

# Example WAF rule (ModSecurity) to block exploitation attempts
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1006043,\
    msg:'Block CVE-2025-6043 Malcure wpmr_delete_file abuse'"
    SecRule ARGS:action "@streq wpmr_delete_file"