📄 WordPress Attachment Manager 2.1.2 File Deletion / Path Traversal

WordPress Attachment Manager plugin version 2.1.2 contains an unauthenticated arbitrary file deletion vulnerability through path traversal. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable...

CVE-2025-7643

creationtimestamp| type| source ---|---|--- 2025-07-18 05:31:19+00:00| seen| Telegram/nq2vauEBS5DPOUr-NWy5KTz64cVbQiCLhvB0xDCHLnSw...

CVE-2025-7643 Attachment Manager <= 2.1.2 - Unauthenticated Arbitrary File Deletion

The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleactions function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...

WordPress Attachment Manager plugin <= 2.1.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin Attachment Manager versions = 2.1.2...