Madara - Core <= 2.2.3 - Niet-geauthenticeerde Willekeurige Bestandverwijdering

The impact of CVE-2025-7712 is severe due to its potential for remote code execution. An attacker can exploit this vulnerability by crafting a malicious request to delete critical files, such as wp-config.php. Deletion of wp-config.php would effectively grant the attacker complete control over the WordPress installation, enabling them to modify the database, upload malicious code, and compromise the entire website. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. Successful exploitation could lead to data breaches, website defacement, and complete system takeover.

WordPress websites utilizing the Madara - Core plugin, particularly those running versions 0.0.0 through 2.2.3, are at significant risk. Shared hosting environments where file permissions are less restrictive are especially vulnerable, as are websites with outdated or unpatched WordPress installations.

• wordpress / composer / npm:

grep -r 'wp_manga_delete_zip' /var/www/html/wp-content/plugins/madara-core/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/madara-core/ | grep -i '2.2.3' # Check version

1. 2025-07-17Disclosure

   disclosure

1. Gereserveerd2025-07-16
2. Gepubliceerd2025-07-17
3. Gewijzigd2026-04-08
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-7712 is to immediately upgrade the Madara - Core plugin to version 2.2.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of the file deletion, restricting file access permissions on the server and carefully reviewing file upload configurations can help reduce the attack surface. Regularly scan the WordPress installation for unauthorized files and monitor server logs for suspicious activity related to file deletion attempts. After upgrading, confirm the fix by attempting a file deletion request through the plugin's interface and verifying that the request is properly rejected.