A directory traversal flaw in the UsersWP plugin allows an authenticated user with Subscriber or higher privileges to delete arbitrary files on the server, including critical configuration files such as wp-config.php, by manipulating the file upload field. The vulnerability arises from the plugin’s validation routine passing file values directly through a generic text sanitizer that preserves traversal characters, and an AJAX handler that concatenates the uploads base path with unfiltered metadata before calling unlink(). As a result, a malicious actor can target files outside the intended uploads directory, leading to data exposure or full server compromise.

The flaw affects the UsersWP front‑end login, registration, profile and members directory plugin produced by stiofansisland. All releases up to and including version 1.2.65 are vulnerable; WordPress sites that have installed this plugin and contain any authenticated user with at least Subscriber level are at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the issue is not included in CISA KEV. Exploitation requires an attacker to authenticate as a Subscriber‑level account or higher and to craft a file upload request that directs the plugin to delete an arbitrary file on the server, including critical configuration files such as wp-config.php; the plugin performs no path canonicalization or boundary checks before calling unlink().