The WordPress User Extra Fields plugin contains an insufficient file path validation flaw in its save_fields() function that allows authenticated users with Subscriber‑level access or higher to delete arbitrary files on the server. This flaw is a Path Traversal issue (CWE‑36). Removing critical configuration files such as wp-config.php can give attackers direct control over the WordPress installation, effectively turning the vulnerability into a remote code execution risk.

All installations of the WordPress User Extra Fields plugin released by Vanquish, up to and including version 16.7, are affected.

The vulnerability scores a CVSS of 8.8, indicating high severity, while the EPSS below 1% suggests a low likelihood that it has been widely exploited to date. Although not listed in the CISA KEV catalog, an attacker would need only authenticated access with a Subscriber role or higher, making the exploitation pathway relatively simple if the plugin is in use. The weakness permits deletion of any user‑supplied file path, providing a potential pivot point for executing code on the host.