CVE-2025-8213

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8213", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-25T19:35:11.742Z", "datePublished": "2025-07-31T12:24:43.148Z", "dateUpdated": "2026-04-08T16:58:57.746Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:57.746Z"}, "affected": [{"vendor": "nintechnet", "product": "NinjaScanner \u2013 Virus & Malware scan", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The NinjaScanner \u2013 Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory."}], "title": "NinjaScanner \u2013 Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/ajax_hooks.php#L331"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/tab_quarantine.php#L114"}, {"url": "https://plugins.trac.wordpress.org/changeset/3336569/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-36 Absolute Path Traversal", "cweId": "CWE-36", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-07-30T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-31T13:10:45.439463Z", "id": "CVE-2025-8213", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T13:10:56.349Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-31T13:10:45.439463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T13:10:51.513Z"}}], "cna": {"title": "NinjaScanner \u2013 Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "nintechnet", "product": "NinjaScanner \u2013 Virus & Malware scan", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-30T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/ajax_hooks.php#L331"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/tab_quarantine.php#L114"}, {"url": "https://plugins.trac.wordpress.org/changeset/3336569/"}], "descriptions": [{"lang": "en", "value": "The NinjaScanner \u2013 Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-36", "description": "CWE-36 Absolute Path Traversal"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:57.746Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8213", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:57.746Z", "dateReserved": "2025-07-25T19:35:11.742Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-31T12:24:43.148Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "NinjaScanner \u2013 Virus & Malware scan", "vendor": "nintechnet", "versions": [{"lessThanOrEqual": "3.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NinjaScanner \u2013 Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory."}, {"lang": "es", "value": "El complemento NinjaScanner \u2013 Virus &amp; Malware scan para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos debido a una validaci\u00f3n insuficiente de la ruta de archivo en las funciones 'nscan_ajax_quarantine' y 'nscan_quarantine_select' en todas las versiones hasta la 3.2.5 incluida. Esto permite que atacantes autenticados, con acceso de administrador o superior, eliminen archivos arbitrarios del servidor, incluso fuera del directorio ra\u00edz de WordPress."}], "id": "CVE-2025-8213", "lastModified": "2026-06-17T10:06:31.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8213", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-31T13:10:45.439463Z", "version": "2.0.3"}}]}, "published": "2025-07-31T13:15:26.770", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/ajax_hooks.php#L331"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/tab_quarantine.php#L114"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3336569/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-36"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:46:20.336225+00:00", "value": {"mitigation_remediation": ["Upgrade NinjaScanner to version 3.2.6 or later, which removes the unchecked path logic", "Limit Administrator privileges to a minimal set of trusted accounts to reduce the attack surface", "If the quarantine feature is not required, disable or uninstall the NinjaScanner plugin to eliminate the vulnerability"], "summary": {"action": "Patch Immediately", "impact": "Arbitrary File Deletion by privileged users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the NinjaScanner \u2013 Virus & Malware scan plugin for WordPress, manufactured by nintechnet. All releases up to and including version 3.2.5 are impacted.", "description_and_impact": "The NinjaScanner \u2013 Virus & Malware scan plugin contains insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions. Administrators or higher\u2011privileged users can exploit these functions to delete arbitrary files on the server, including files located outside the WordPress root directory. This allows the attacker to modify or remove critical system files, potentially leading to defacement, denial of service, or facilitating further compromise.", "risk_and_exploitability": "The CVSS score of 7.2 denotes a high severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Administrator level or higher, and the attacker must use the WordPress admin interface to trigger the vulnerable quarantine functions. No public exploits have been confirmed, but the lack of file path checks presents a serious integrity risk for sites running the affected plugin."}}}}, "created": "2025-07-31T19:36:26.559454+00:00", "updated": "2026-04-21T04:00:10.052460+00:00", "vendors": ["nintechnet", "nintechnet$PRODUCT$ninjascanner", "wordpress", "wordpress$PRODUCT$wordpress"]}