EUVD-2025-16961
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3Tags
Description
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Analysis
WP User Frontend Pro plugin versions up to 4.1.3 contain an arbitrary file deletion vulnerability in the delete_avatar_ajax() function that allows authenticated Subscriber-level users to delete critical files on WordPress servers without proper path validation. Successful exploitation can lead to remote code execution by deleting sensitive files such as wp-config.php, and the vulnerability is actively exploitable with no user interaction required. This represents a critical post-authentication privilege escalation affecting a widely-used WordPress plugin.
Technical Context
The vulnerability exists in the WP User Frontend Pro WordPress plugin (CPE: wp:wp-user-frontend-pro), specifically in the AJAX handler delete_avatar_ajax() function. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal), where insufficient validation of file path parameters allows attackers to reference files outside the intended directory scope. The vulnerable AJAX endpoint processes file deletion requests from authenticated users without properly sanitizing or validating the file path, enabling traversal to arbitrary locations on the filesystem. WordPress relies on capability checks and nonces for AJAX security, and while basic authentication is required (Subscriber+), the path validation failure creates a secondary control bypass that permits deletion of system-critical files.
Affected Products
WP User Frontend Pro plugin for WordPress: all versions up to and including 4.1.3. Affected product identifier: wp:wp-user-frontend-pro (versions <=4.1.3). The vulnerability affects any WordPress installation with: (1) WP User Frontend Pro plugin version 4.1.3 or earlier, (2) open user registration or existing low-privileged user accounts, (3) WordPress with default AJAX nonce handling. Enterprise installations using this plugin for frontend user profile editing are at highest risk. No version-specific CPE breakdowns suggest the issue exists across all 4.x and earlier releases.
Remediation
Immediate actions: (1) Update WP User Frontend Pro to version 4.1.4 or later as soon as available from the official WordPress plugin repository. (2) If immediate patching is not possible, disable the WP User Frontend Pro plugin entirely until a patch is released. (3) Implement Web Application Firewall (WAF) rules to block suspicious delete_avatar_ajax() requests containing path traversal sequences (../, ..\, encoded variants). (4) Restrict user registration to trusted users only via wp-admin settings if not required for business logic. (5) Apply the principle of least privilege: ensure WordPress and plugin file permissions are properly configured (wp-config.php should be 0644, not world-writable). (6) Monitor file access logs for unexpected deletion of critical files (wp-config.php, .htaccess, index.php). (7) Maintain current backups to enable rapid recovery if files are deleted. (8) Contact the plugin vendor (Wedevs) for an official security advisory and patch timeline if not yet released. Vendor advisory should be published at https://wordpress.org/plugins/wp-user-frontend/ or the vendor's security page.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today