WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion

The core of the vulnerability lies in the deleteavatarajax() function, which lacks proper file path validation. An attacker can craft a malicious request to delete any file the web server user has write access to. While deleting avatar images might seem trivial, the ability to delete wp-config.php is a critical escalation path. Deleting wp-config.php effectively disables the WordPress site and allows an attacker to potentially upload a malicious PHP script, granting them complete control over the server. This is a classic attack vector for gaining persistent access and deploying malware. The ease of exploitation, combined with the potential for complete server compromise, makes this a high-priority vulnerability.

WordPress sites utilizing the WP User Frontend Pro plugin, particularly those with a large number of users with Subscriber or higher roles, are at significant risk. Shared hosting environments where users have limited control over server file permissions are also particularly vulnerable. Sites relying on older, unpatched versions of the plugin are most exposed.

• wordpress / composer / npm:

grep -r 'delete_avatar_ajax' /var/www/html/wp-content/plugins/wp-user-frontend-pro/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'wp-user-frontend-pro'

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-content/plugins/wp-user-frontend-pro/ | grep -i 'wp-config.php'

1. 2025-06-05Disclosure

   disclosure

1. Reserviert2025-03-31
2. Veröffentlicht2025-06-05
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the WP User Frontend Pro plugin to version 4.1.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file write permissions for the web server user to only the necessary directories. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious file paths or attempts to access sensitive files like wp-config.php. Regularly review file permissions and ensure that the WordPress installation follows security best practices. After upgrading, verify the fix by attempting to delete a non-avatar file via the plugin's AJAX endpoint; the request should be rejected.