CVE-2025-7641 is a path traversal vulnerability (CWE-22) in the Assistant for NextGEN Gallery WordPress plugin, affecting all versions up to and including 1.0.9. The issue arises from inadequate validation of file paths in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint, which permits unauthenticated attackers to delete arbitrary directories on the server. This can result in significant availability impact by removing critical files or directories. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.

Successful exploitation allows unauthenticated attackers to delete arbitrary directories on the server hosting the WordPress plugin, potentially causing complete loss of availability of the affected service or website. There is no confidentiality or integrity impact reported. No known exploits in the wild have been documented at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to the vulnerable REST endpoint if possible, for example by limiting access via web application firewall rules or other access controls. Monitor vendor channels for updates and apply official patches once available.