CVE-2025-7772
📋 TL;DR
This vulnerability in the Malcure Malware Scanner WordPress plugin allows authenticated attackers with subscriber-level access or higher to read arbitrary files on the server. The flaw exists in the wpmr_inspect_file() function which lacks proper capability checks, potentially exposing sensitive information like configuration files, credentials, or database contents. All WordPress sites using this plugin up to version 16.8 are affected.
💻 Affected Systems
- Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive files like wp-config.php containing database credentials, SSH keys, or other configuration files, leading to complete site compromise and potential lateral movement to other systems.
Likely Case
Attackers exfiltrate sensitive configuration files, database credentials, or other site data, potentially enabling further attacks or data theft.
If Mitigated
With proper access controls and monitoring, unauthorized file access attempts are detected and blocked before sensitive data is exposed.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has valid credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 16.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Malcure Malware Scanner' and check if update is available. 4. Click 'Update Now' or manually update to version after 16.8. 5. Verify plugin is updated to latest version.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Malcure Malware Scanner plugin until patched
wp plugin deactivate wp-malware-removal
Restrict user capabilities
allRemove file read capabilities from subscriber and other low-privilege roles
wp role reset subscriber
wp cap remove subscriber read
🧯 If You Can't Patch
- Disable the Malcure Malware Scanner plugin immediately
- Implement strict access controls and monitor for suspicious file read attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for Malcure Malware Scanner version 16.8 or earlierCheck Version:
wp plugin get wp-malware-removal --field=versionVerify Fix Applied:
Verify plugin version is higher than 16.8 in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in WordPress or web server logs
- Multiple requests to wpmr_inspect_file endpoint from single user
- Access attempts to sensitive files like wp-config.php
Network Indicators:
- Outbound transfers of large configuration files
- Unusual data exfiltration patterns
SIEM Query:
source="wordpress" AND (uri_path="*wpmr_inspect_file*" OR file_access="wp-config.php")