An authenticated user with subscriber level or higher privileges can delete arbitrary files on the web server. The flaw arises because stored values for file‑type custom profile fields are not validated, allowing a path to be saved instead of a standard upload location. During deletion the sanitization function only remaps paths that match an expected pattern, and the resulting path is passed directly to the unlink() call. If an attacker chooses a critical file such as wp-config.php, the deletion can lead to a full compromise of the WordPress installation.

The WordPress plugin wpForo Forum, versions up to and including 3.0.5, is affected. The vulnerability requires the wpForo – User Custom Fields addon plugin, which must be installed for custom profile fields to exist.

The CVSS score of 8.1 highlights a high severity issue. With no EPSS entry and absence from the KEV catalog, the estimated likelihood of exploitation is uncertain but the existence of an authenticated attack path and potential for remote code execution is sufficient to consider the risk moderate to high. An attacker only needs access to a subscriber or higher role and the ability to modify a custom profile field to exploit the flaw.