PT-2025-31521 · WordPress · Wordpress+1

Jonas Benjamin Friedli · Published 2025-07-31 · Updated 2025-08-05 · CVE-2025-8213

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NinjaScanner – Virus & Malware scan plugin for WordPress versions through 3.2.5

Description The NinjaScanner – Virus & Malware scan plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation. This issue affects the nscan ajax quarantine and nscan quarantine select functions. Authenticated attackers possessing Administrator-level access or higher can exploit this to delete arbitrary files on the server, potentially including files located outside the WordPress root directory.

Recommendations Versions prior to 3.2.5 should be updated. As a temporary workaround, restrict access to the nscan ajax quarantine and nscan quarantine select functions until a patch is available.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-8213

Affected Products

Ninjascanner

Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-8213 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=cve · Note
• https://t.me/CVEtracker/28857 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1950947910826201186 · Twitter Post
• https://twitter.com/cracbot/status/1952686079728857488 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/ajax_hooks.php#L331 · Note
• https://twitter.com/CVEnew/status/1950910053730439450 · Twitter Post
• https://t.me/cveNotify/130379 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/tab_quarantine.php#L114 · Note
• https://plugins.trac.wordpress.org/changeset/3336569 · Note