CVE-2025-7643 is a critical path traversal vulnerability in the Attachment Manager WordPress plugin by aaroncampbell. The vulnerability arises from improper limitation of file pathnames in the handle_actions() function, allowing unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are deleted. The issue affects all versions up to and including 2.1.2. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No patch or official fix has been documented in the provided data.

An attacker can delete arbitrary files on the server without authentication, potentially causing denial of service or enabling remote code execution by removing critical files such as wp-config.php. This compromises the integrity and availability of the affected system. Confidentiality is not directly impacted according to the CVSS vector. The vulnerability poses a critical risk to WordPress sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and consider disabling or removing the Attachment Manager plugin if possible. Monitor for updates from the vendor or WordPress plugin repository to apply an official fix once released.