Malcure Malware Scanner WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Malcure Malware Scanner WordPress plugin, in all versions through 16.8. This issue arises from a missing capability check in the wpmr_delete_file() function, which enables authenticated attackers with Subscriber-level access or higher to delete arbitrary files. The vulnerability could potentially be exploited for remote code execution, but only if advanced mode is activated on the site.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files, with the potential for remote code execution if certain conditions are met.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.