Attachment Manager ≤2.1.2: CVE-2025-7643 and the Perils of Unauthenticated File Deletion in WordPress

CVE-2025-7643, a critical vulnerability in the Attachment Manager plugin, lets a single HTTP request take down an entire WordPress site. It has a CVSS score of 9.1, and it lets unauthenticated attackers delete arbitrary files, including wp-config.php. It is a textbook case of a seemingly minor plugin oversight leading to catastrophic compromise.

What Is Attachment Manager?

Attachment Manager is a third-party WordPress plugin for managing and organizing media attachments. Its install base is small, but hundreds of sites have used it to handle their files. Limited adoption and maintenance by a small developer team have contributed to a history of severe vulnerabilities.

Technical Information

Vulnerability Mechanism

CVE-2025-7643 sits in the handle_actions() function, which processes file operations based on user-supplied parameters. In all versions up to and including 2.1.2, the function does not validate the file path passed in the file parameter. It also does not check whether the request is authenticated or authorized.

An attacker can therefore send a crafted HTTP request to the vulnerable endpoint and use directory traversal sequences (../) to reach files outside the intended directory. For example:

GET /wp-content/plugins/attachment-manager/lib/php/handle_actions.php?action=remove&file=../../../wp-config.php

This request tells the plugin to delete the site's wp-config.php file, which holds the database credentials and which WordPress needs in order to run. Deleting this file can:

• Render the site inoperable
• Allow an attacker to reinitialize WordPress with their own database settings, potentially executing arbitrary code
• Open the way to further attacks such as privilege escalation or lateral movement

The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Attack Vectors and Exploitation

• No authentication is required, so any external actor can exploit the flaw.
• The file parameter is not sanitized, so attackers can use directory traversal to name any file on the server that the web process can access.
• Deleting files such as .htaccess, wp-config.php, or plugin files can lead to denial of service or remote code execution.

Vulnerable Code Pattern

The exact vulnerable code is not public. The flaw is described as insufficient validation of the file parameter in the handle_actions() function, which follows this pattern:

$file = $_GET['file'];
@unlink($file);

Nothing restricts $file to a safe directory, and nothing checks the requester's permissions.

Affected Systems and Versions

• Product: Attachment Manager plugin for WordPress
• Vulnerable Versions: All versions up to and including 2.1.2
• Fixed Version: 2.1.3 (users must update to this version or later)
• Configuration: Any WordPress site with the vulnerable plugin enabled is at risk, regardless of other security plugins or settings.

Vendor Security History

The plugin has had severe vulnerabilities before:

• 2016: Arbitrary file upload vulnerability in v2.1.1, fixed in 2.1.2 (Acunetix, Plugin Vulnerabilities).
• 2025: Arbitrary file deletion (CVE-2025-7643) in ≤2.1.2, fixed in 2.1.3.

No large vendor actively maintains the plugin, and there is no evidence of a formal security response process. Users should consider moving to better-supported alternatives.

References

• NVD Entry for CVE-2025-7643
• Official CVE Entry
• WordPress Plugin Page
• Wordfence Advisory
• SecAlerts Advisory
• Historical Arbitrary File Upload Vulnerability

---

Summary: CVE-2025-7643 is a critical, trivially exploitable flaw in Attachment Manager ≤2.1.2. Patch or remove the plugin immediately. Its history of severe vulnerabilities and its thin vendor support make it unsuitable for production use.

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]