Description
The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Published: 2025-06-05
Score: 8.1 High
EPSS: 5.6% Low
KEV: No
Impact: Remote Code Execution via arbitrary file deletion
Action: Immediate Patch
AI Analysis

Impact

The vulnerability appears in the delete_avatar_ajax() function of WP User Frontend Pro, where user-supplied file paths are not properly validated before deletion. This allows an authenticated attacker with Subscriber role or higher to specify any filesystem path, leading to arbitrary file removal. Deleting critical files such as wp-config.php can compromise WordPress configuration and permit execution of malicious code. The flaw represents a classic path traversal and deletion abuse (CWE-22).

Affected Systems

WP User Frontend Pro (wedevs) versions up to and including 4.1.3 on WordPress sites. The issue affects all installations that have been running these versions without an upgrade.

Risk and Exploitability

The CVSS score of 8.1 marks this as a high‑severity vulnerability. With an EPSS score of 6%, there is a moderate probability of exploitation. The flaw is not listed in the CISA KEV catalog, but its impact—remote code execution through file deletion—makes it a significant risk. An attacker must be able to authenticate to the WordPress site as a Subscriber or higher and then issue a crafted AJAX request to the delete_avatar_ajax() endpoint. Once the request is processed, any file on the server may be deleted, exposing the system to further compromise.

Generated by OpenCVE AI on April 21, 2026 at 20:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WP User Frontend Pro to the latest version, at minimum 4.2.0, to remove the deletion flaw.
  • Restrict the delete avatar functionality for Subscriber accounts, for example by disabling the feature or limiting role access to the AJAX endpoint until an update can be applied.
  • Ensure the WordPress install runs with the least privileged filesystem permissions, back up critical configuration files, and monitor server logs for unexpected file deletion activity.

Generated by OpenCVE AI on April 21, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-16961 The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
History

Thu, 05 Jun 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Jun 2025 05:45:00 +0000

Type Values Removed Values Added
Description The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Title WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:31:49.338Z

Reserved: 2025-03-31T19:27:42.132Z

Link: CVE-2025-3055

cve-icon Vulnrichment

Updated: 2025-06-05T13:18:31.532Z

cve-icon NVD

Status : Deferred

Published: 2025-06-05T06:15:26.300

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-3055

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T20:30:27Z

Weaknesses