CVE-2025-13320
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2Description
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled.
Analysis
Arbitrary file deletion in WP User Manager plugin versions up to 2.9.12 allows authenticated attackers with Subscriber-level privileges to delete critical files via improper validation of the 'current_user_avatar' parameter when custom avatar functionality is enabled. The vulnerability exploits PHP's filter_input() function's handling of array inputs combined with insufficient path validation, enabling a two-stage attack that can facilitate remote code execution by deleting essential files. No public exploit code has been identified at the time of analysis, though the low EPSS score (0.29%) suggests limited real-world exploitation likelihood despite the moderate CVSS rating.
Technical Context
The vulnerability exists in WP User Manager's profile update functionality, specifically in the trait-wpum-account.php file where user-supplied file paths are processed via the 'current_user_avatar' parameter. PHP's filter_input() function, when applied to array inputs without proper validation, fails to enforce path restrictions that should prevent directory traversal attacks. CWE-73 (External Control of File Name or Path) indicates the root cause is inadequate validation and sanitization of user-supplied input before it is used in file system operations. When the custom avatar setting is enabled, this flaw allows an attacker to manipulate the avatar upload/update mechanism to reference and delete arbitrary files on the server. The two-stage attack nature suggests the first stage involves path traversal to identify target files, and the second stage executes the deletion.
Affected Products
WP User Manager plugin for WordPress in all versions up to and including 2.9.12 is affected. The vulnerability only manifests when the custom avatar setting is enabled within the plugin configuration. Wordfence has documented the specific vulnerable code paths in the trait-wpum-account.php file at lines 70, 75, and 86. Users should consult the official Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8304bf-bec2-4fcf-9fe2-46b626b3dae9 and the WordPress plugin repository commit history at https://plugins.trac.wordpress.org/changeset/3420956/wp-user-manager/trunk/includes/forms/trait-wpum-account.php for version-specific details and patch availability.
Remediation
Update WP User Manager to a patched version released after 2.9.12 that implements proper input validation and sanitization for file path handling in the profile update functionality. Disable the custom avatar feature in WP User Manager settings as an immediate workaround if patching cannot be deployed immediately. Additionally, restrict Subscriber-level access to profile update functionality at the WordPress level if custom avatar is not required for your site's functionality. Review the official patch in the plugin repository at https://plugins.trac.wordpress.org/changeset/3420956/wp-user-manager/trunk/includes/forms/trait-wpum-account.php to verify the fix addresses improper filter_input() handling and validates file paths against directory traversal attempts. Wordfence provides detailed mitigation guidance at their vulnerability advisory.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today