CVE-2025-7667

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7667", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-14T21:43:01.363Z", "datePublished": "2025-07-15T11:20:04.307Z", "dateUpdated": "2026-04-08T17:28:52.350Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:52.350Z"}, "affected": [{"vendor": "josxha", "product": "Restrict File Access", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/admin/admin.php#L78"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-07-14T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-15T13:14:09.770065Z", "id": "CVE-2025-7667", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-15T13:14:26.317Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-15T13:14:09.770065Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-15T13:14:21.680Z"}}], "cna": {"title": "Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}}], "affected": [{"vendor": "josxha", "product": "Restrict File Access", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-14T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/admin/admin.php#L78"}], "descriptions": [{"lang": "en", "value": "The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:52.350Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7667", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:52.350Z", "dateReserved": "2025-07-14T21:43:01.363Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-15T11:20:04.307Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Restrict File Access", "vendor": "josxha", "versions": [{"lessThanOrEqual": "1.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Restrict File Access para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.1.2 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la p\u00e1gina \"restrict-file-access\". Esto permite a atacantes no autenticados eliminar archivos arbitrarios en el servidor, lo que puede provocar f\u00e1cilmente la ejecuci\u00f3n remota de c\u00f3digo al eliminar el archivo correcto (como wp-config.php). Mediante una solicitud falsificada, pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-7667", "lastModified": "2026-06-17T10:05:26.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7667", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-15T13:14:09.770065Z", "version": "2.0.3"}}]}, "published": "2025-07-15T12:15:22.990", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/admin/admin.php#L78"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:18:02.496881+00:00", "value": {"mitigation_remediation": ["Update the Restrict File Access plugin to the latest non\u2011vulnerable release (any version above 1.1.2).", "If an upgrade is not immediately feasible, disable the plugin\u2019s administrative pages for all users except the site administrator by applying a role\u2011based restriction or temporarily removing the plugin from the site.", "Implement additional CSRF protection on the site, such as enforcing nonces on all admin forms or using a security plugin that validates nonce tokens for sensitive actions."], "summary": {"action": "Patch immediately", "impact": "Unauthenticated file deletion leading to remote code execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Restrict File Access plugin with a version equal to or older than 1.1.2 are impacted. The vulnerability is vendor specific to the plugin provided by josxha. No other versions or plugins are listed as affected.", "description_and_impact": "The Restrict File Access plugin for WordPress allows an attacker without authentication to delete any file on the server by exploiting a missing or incorrect nonce validation on the plugin\u2019s configuration page. The flaw provides a clear pathway for an attacker to remove critical files, such as wp-config.php, which can then be used to hijack the site and execute arbitrary code. The vulnerability is classified as Cross\u2011Site Request Forgery (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity of exploitation. The EPSS score of less than 1% suggests that the overall probability of exploitation in the wild is currently low, but the known vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability via a forged link or form submission that lacks proper nonce verification, enabling them to delete arbitrary files. Because the exploit does not require privileged credentials and can be executed by a remote entity, it remains a significant risk to affected sites."}}}}, "created": "2026-04-20T20:30:16.066034+00:00", "updated": "2026-04-20T20:30:16.066044+00:00", "vendors": []}