NinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion
highThe NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Admi...
- CVSS:
- 7.2
- Affected:
- up to 3.2.5
- Fixed in:
- 3.2.6
- Disclosed:
- Jul 30, 2025