CVE-2025-7667 is a CSRF vulnerability in the josxha Restrict File Access WordPress plugin affecting all versions up to 1.1.2. The issue arises from missing or incorrect nonce validation on the 'restrict-file-access' page, enabling unauthenticated attackers to craft requests that, when executed by an authenticated administrator, delete arbitrary files on the server. This can escalate to remote code execution if sensitive files like wp-config.php are deleted. The vulnerability has a CVSS v3.1 score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating network attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server by tricking an administrator into executing a forged request. This can lead to remote code execution if critical files such as wp-config.php are deleted, severely compromising the affected WordPress site’s integrity and availability.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming official patches promptly. Until a fix is released, administrators should avoid interacting with untrusted links or requests related to the 'restrict-file-access' page to prevent CSRF exploitation.