CVE-2025-69377

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Published Feb 20, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

Analysis

Technical impact

The vulnerability is an improper limitation of a pathname to a restricted directory, enabling path traversal and arbitrary deletion of files. An attacker can cause loss of critical files, potentially disrupting site operation or corrupting data. This weakness falls under CWE‑22.

Affected Systems

The flaw affects the WordPress User Extra Fields plugin developed by vanquish, with all releases up to version 17.0 being vulnerable. Any WordPress installation that uses the plugin before the 17.1 update is exposed to this issue.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1 percent suggests exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog. Exploitation most likely requires a web-based request that can influence the file path parameter sent to the plugin’s deletion routine; no explicit authentication or elevated privileges are mentioned, indicating local control of the site may suffice.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vanquish

User Extra Fields

unaffected

Version	Status	Constraints
`0`	affected	≤ 17.0

No data.

Vendor Product Versions

Vanquish

User Extra Fields

Version	Status	Scheme	Platform
`[0,17.0]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the User Extra Fields plugin to version 17.1 or later, which removes path traversal handling.
If upgrading is not immediately possible, disable or delete the plugin’s file deletion functionality or block access to the endpoint that performs deletions.
Apply the principle of least privilege by ensuring that web server processes have only the permissions necessary for serving content, preventing them from deleting critical files.

Generated by OpenCVE AI on April 27, 2026 at 20:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.530% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-17-0-arbitrary-file-deletion-vulnerability-2?_s_id=cve

History

Feb 27, 2026 6:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 25, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}`

Feb 23, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vanquish Vanquish user Extra Fields Wordpress Wordpress wordpress
Vendors & Products		Vanquish Vanquish user Extra Fields Wordpress Wordpress wordpress

Feb 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
Title		WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability
Weaknesses		CWE-22
References		https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-17-0-arbitrary-file-deletion-vulnerability-2?_s_id=cve