Technical impact
The WP User Manager plugin processes user‑supplied file paths in the avatar upload form without sufficient validation, allowing a specially crafted current_user_avatar parameter to delete any file on the webserver that the WordPress process can write to. This is a CWE‑73 vulnerability and the resulting deletion can compromise site integrity and, if combined with a file‑replacement technique, enable remote code execution by an attacker who is logged in with Subscriber‑level or higher access.
Affected Systems
WP User Manager – User Profile Builder & Membership for WordPress, all versions 2.9.12 and earlier, is affected when the custom avatar feature is enabled. Any site running a vulnerable version with that setting active is susceptible.
Risk and Exploitability
The CVSS score of 6.8 marks the issue as moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate with a Subscriber or higher role and submit a form that supplies a crafted path for current_user_avatar; the PHP filter_input() handling of array inputs allows a two‑step deletion, which can be leveraged to remove critical files or introduce malicious code, potentially leading to remote code execution. While the attack requires web‑site access, the impact is local to the site and could be amplified if the attacker gains control of the file system.
