CVE-2025-7712 is a path traversal vulnerability (CWE-22) in the Madara - Core WordPress plugin, specifically in the wp_manga_delete_zip() function. Insufficient validation of file paths allows unauthenticated attackers to delete arbitrary files on the affected server. This can lead to severe consequences including remote code execution if critical files like wp-config.php are deleted. The vulnerability affects all versions up to and including 2.2.3. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

Successful exploitation permits unauthenticated attackers to delete arbitrary files on the server hosting the vulnerable plugin. This can disrupt service availability and compromise server integrity. Deletion of critical files such as wp-config.php may enable attackers to achieve remote code execution, escalating the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and consider disabling or removing it to prevent exploitation. Monitor official MangaBooth communications for updates on patches or mitigations.