Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
high
The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'restrict-file-access' page. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server,...
- CVSS:
- 8.1
- Affected:
- up to 1.1.2
- Fix:
- No patched version reported
- Disclosed:
- Jul 14, 2025
CVE-2025-7667 on NVD →
Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read
medium
The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain s...
- CVSS:
- 6.5
- Affected:
- up to 1.1.2
- Fix:
- No patched version reported
- Disclosed:
- Jun 13, 2025
CVE-2025-6070 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database