PT-2025-37289 · WordPress · Lws Cleaner

Jonas Benjamin Friedli · Published 2025-09-12 · Updated 2025-09-17 · CVE-2025-8575

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: LWS Cleaner plugin for WordPress versions up to and including 2.4.1.3

Description: The LWS Cleaner plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the lws cl delete file function. This allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. Deletion of specific files, such as wp-config.php, could lead to remote code execution.

Recommendations: Update the LWS Cleaner plugin to a version newer than 2.4.1.3.

Fix

RCE

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-8575

Affected Products

Lws Cleaner

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-8575 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fa37025a-7f20-4cfe-a7d0-38168f49b6d9?source=cve · Note
• https://twitter.com/cracbot/status/1968268749116747937 · Twitter Post
• https://twitter.com/CVEnew/status/1966393337423745086 · Twitter Post
• https://t.me/CVEtracker/32356 · Telegram Post
• https://plugins.trac.wordpress.org/browser/lws-cleaner/trunk/lws-cleaner.php#L1144 · Note
• https://twitter.com/SecAideInfo/status/1967169418263171202 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3359598 · Note
• https://twitter.com/VulmonFeeds/status/1966424027993379210 · Twitter Post