Technical impact
The WordPress User Extra Fields plugin contains an insufficient file path validation flaw in its save_fields() function that allows authenticated users with Subscriber‑level access or higher to delete arbitrary files on the server. This flaw is a Path Traversal issue (CWE‑36). Removing critical configuration files such as wp-config.php can give attackers direct control over the WordPress installation, effectively turning the vulnerability into a remote code execution risk.
Affected Systems
All installations of the WordPress User Extra Fields plugin released by Vanquish, up to and including version 16.7, are affected.
Risk and Exploitability
The vulnerability scores a CVSS of 8.8, indicating high severity, while the EPSS below 1% suggests a low likelihood that it has been widely exploited to date. Although not listed in the CISA KEV catalog, an attacker would need only authenticated access with a Subscriber role or higher, making the exploitation pathway relatively simple if the plugin is in use. The weakness permits deletion of any user‑supplied file path, providing a potential pivot point for executing code on the host.
