What is the CVSS score of CVE-2025-3055?

CVE-2025-3055 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 2.2%.

Which versions of PHP are affected by CVE-2025-3055?

WP User Frontend Pro plugin contains a critical vulnerability allowing authenticated users to delete arbitrary files from WordPress servers, potentially leading to complete system compromise and data…

How to fix or mitigate CVE-2025-3055?

Within 24 hours: Disable the WP User Frontend Pro plugin and audit recent file deletion logs for suspicious activity. Within 7 days: Evaluate alternative solutions or contact vendor for patched version availability; implement WAF rules blocking avatar deletion requests. Within 30 days: Complete migration to a patched version or alternative plugin, restore any deleted critical files from backups, and conduct full security assessment of affected systems.

PHP CVE-2025-3055

EUVD-2025-16961 HIGH

Path Traversal (CWE-22)

2025-06-05 security@wordfence.com

WordPress PHP RCE Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16961

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

CVE Published

Jun 05, 2025 - 06:15 nvd

HIGH 8.1

DescriptionCVE.org

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

AnalysisAI

WP User Frontend Pro plugin versions up to 4.1.3 contain an arbitrary file deletion vulnerability in the delete_avatar_ajax() function that allows authenticated Subscriber-level users to delete critical files on WordPress servers without proper path validation. Successful exploitation can lead to remote code execution by deleting sensitive files such as wp-config.php, and the vulnerability is actively exploitable with no user interaction required. This represents a critical post-authentication privilege escalation affecting a widely-used WordPress plugin.

Technical ContextAI

The vulnerability exists in the WP User Frontend Pro WordPress plugin (CPE: wp:wp-user-frontend-pro), specifically in the AJAX handler delete_avatar_ajax() function. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal), where insufficient validation of file path parameters allows attackers to reference files outside the intended directory scope. The vulnerable AJAX endpoint processes file deletion requests from authenticated users without properly sanitizing or validating the file path, enabling traversal to arbitrary locations on the filesystem. WordPress relies on capability checks and nonces for AJAX security, and while basic authentication is required (Subscriber+), the path validation failure creates a secondary control bypass that permits deletion of system-critical files.

RemediationAI

Immediate actions: (1) Update WP User Frontend Pro to version 4.1.4 or later as soon as available from the official WordPress plugin repository. (2) If immediate patching is not possible, disable the WP User Frontend Pro plugin entirely until a patch is released. (3) Implement Web Application Firewall (WAF) rules to block suspicious delete_avatar_ajax() requests containing path traversal sequences (../, ..\, encoded variants). (4) Restrict user registration to trusted users only via wp-admin settings if not required for business logic. (5) Apply the principle of least privilege: ensure WordPress and plugin file permissions are properly configured (wp-config.php should be 0644, not world-writable). (6) Monitor file access logs for unexpected deletion of critical files (wp-config.php, .htaccess, index.php). (7) Maintain current backups to enable rapid recovery if files are deleted. (8) Contact the plugin vendor (Wedevs) for an official security advisory and patch timeline if not yet released. Vendor advisory should be published at https://wordpress.org/plugins/wp-user-frontend/ or the vendor's security page.