CVE-2025-8213 describes an absolute path traversal vulnerability in the NinjaScanner – Virus & Malware scan WordPress plugin. The issue arises from inadequate validation of file paths in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions, allowing authenticated administrators to delete arbitrary files on the server filesystem, potentially impacting system integrity beyond the WordPress installation directory. The vulnerability affects all plugin versions up to and including 3.2.5. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Administrator privileges to delete any file on the server, including critical system files outside the WordPress root directory. This can lead to denial of service, data loss, or compromise of server stability and security. The vulnerability impacts confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletion. Avoid using affected plugin versions if possible or consider disabling the plugin temporarily to prevent exploitation.