NinjaScanner – Virus & Malware scan

CVE Details

Basic Information

Title	NinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion
Type	cve
Published	2025-07-31T12:24:43.148Z
Modified	2025-07-31T13:10:56.349Z

Product Information

Vendor	nintechnet
Product	NinjaScanner – Virus & Malware scan
Version	*

CVSS Information

Base Score	7.2 (HIGH)
Attack Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Analysis

AI Description	The NinjaScanner WordPress plugin is vulnerable to arbitrary file deletion due to insufficient file path validation. This allows authenticated attackers with Administrator access to delete files outside the WordPress root directory. This vulnerability affects all versions up to 3.2.5.
AI Severity	High
AI Vendor	WordPress Community
AI Product	NinjaScanner
AI Version	up to 3.2.5

Affected Products

nintechnet NinjaScanner – Virus & Malware scan *

Additional Information

CWE List	CWE-36
Source	Wordfence

Description

The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ‘nscan_ajax_quarantine’ and ‘nscan_quarantine_select’ functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory.

References

View Full CVE Details