Attachment Manager <= 2.1.2 - 認証されていない任意のファイル削除

The impact of CVE-2025-7643 is severe. An unauthenticated attacker can leverage this vulnerability to delete any file accessible to the webserver user. The most critical scenario involves deleting the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and potentially expose database information if backups are not properly secured. Furthermore, an attacker could delete other critical files required for WordPress functionality, leading to a complete compromise of the web server. This vulnerability shares similarities with other file deletion vulnerabilities where the attacker gains control by manipulating file paths.

Websites using the WordPress Attachment Manager plugin, particularly those running older versions (0.0.0–2.1.2), are at significant risk. Shared hosting environments are especially vulnerable as they often have limited access controls and are more susceptible to plugin-based attacks. Sites with weak file permissions or inadequate WAF protection are also at increased risk.

• wordpress / plugin:

wp plugin list | grep "Attachment Manager"

• wordpress / plugin: Check plugin version in wp-content/plugins/attachment-manager/readme.txt. • wordpress / plugin: Search plugin files for the handle_actions() function and look for insecure file path handling. • generic web: Monitor web server access logs for requests containing path traversal sequences (e.g., ../) targeting plugin endpoints. • generic web: Check WordPress plugin directory for reports of exploitation attempts.

1. 2025-07-18Disclosure

   disclosure

1. 予約済み2025-07-14
2. 公開日2025-07-18
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-7643 is to immediately upgrade the WordPress Attachment Manager plugin to version 2.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting file upload permissions for unauthenticated users or implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file paths. Specifically, WAF rules should be configured to deny requests containing path traversal sequences (e.g., ../) in the filename parameter. After upgrading, verify the fix by attempting to access and delete a non-critical file through the plugin's interface to ensure that file path validation is properly enforced.