CVE-2025-4828
📋 TL;DR
This vulnerability in the Support Board WordPress plugin allows attackers to delete arbitrary files on the server due to insufficient path validation. It affects all versions up to and including 3.8.0, potentially leading to remote code execution if critical files like wp-config.php are deleted. Attackers can exploit this unauthenticated by leveraging CVE-2025-4855.
💻 Affected Systems
- Support Board plugin for WordPress
📦 What is this software?
Support Board by Schiocco
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data loss, or site defacement.
Likely Case
Arbitrary file deletion causing service disruption, data corruption, or privilege escalation.
If Mitigated
Limited impact if file permissions are restrictive or the plugin is disabled, but risk remains if unpatched.
🎯 Exploit Status
Exploitation is straightforward if combined with CVE-2025-4855; no public proof-of-concept is known, but weaponization is likely due to high CVSS score and impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 3.8.0 (check vendor for exact version)
Vendor Advisory: https://codecanyon.net/item/support-board-help-desk-and-chat/20359943
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Support Board plugin and update to the latest version. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable the plugin
allTemporarily deactivate the Support Board plugin to prevent exploitation.
wp plugin deactivate support-board
🧯 If You Can't Patch
- Restrict file permissions to critical directories like wp-content/plugins/support-board to prevent deletion.
- Implement web application firewall (WAF) rules to block requests targeting the sb_file_delete function.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 3.8.0 or lower, it is vulnerable.Check Version:
wp plugin get support-board --field=versionVerify Fix Applied:
After updating, confirm the plugin version is above 3.8.0 and test functionality to ensure no disruption.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with action=sb_file_delete
- File deletion events in server logs for unexpected paths
Network Indicators:
- HTTP requests with parameters targeting file paths in the sb_file_delete function
SIEM Query:
source="web_server_logs" AND uri="/wp-admin/admin-ajax.php" AND action="sb_file_delete"