PT-2025-29542 · WordPress · Restrict File Access

Johannes Skamletz + 1 · Published 2025-07-15 · Updated 2025-07-31 · CVE-2025-7667

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Restrict File Access plugin for WordPress versions up to and including 1.1.2

Description The Restrict File Access plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'restrict-file-access' page. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if a critical file, such as wp-config.php, is deleted through a forged request initiated by tricking a site administrator into performing an action.

Recommendations Update the Restrict File Access plugin to a version later than 1.1.2.

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-7667

Affected Products

Restrict File Access

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-7667 · Security Note
• https://t.me/cvenotify/128977 · Telegram Post
• https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/admin/admin.php#L78 · Note
• https://twitter.com/VulmonFeeds/status/1945097802079445104 · Twitter Post
• https://twitter.com/jmdevlabs/status/1950915053227569218 · Twitter Post
• https://twitter.com/cracbot/status/1946887864698171866 · Twitter Post
• https://twitter.com/CVEnew/status/1945087301828194708 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=cve · Note
• https://t.me/cvetracker/27850 · Telegram Post