CVE-2025-7772

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 16.8 via the wpmr_inspect_file() function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 18, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-77738.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an inte CVE-2025-77748.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a CVE-2025-77759.8Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScale CVE-2025-77769.8Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway wh CVE-2025-77776.5The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform maliciou CVE-2025-77789.8The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validati CVE-2025-77798.8Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before CVE-2025-77806.5The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTr CVE-2025-77816.4The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parame CVE-2025-77827.6The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capabi CVE-2025-77839.4Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with CVE-2025-77846.5A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administr