User Meta – User Profile Builder und User management Plugin <= 3.1.2 - Authentifizierter (Subscriber+) willkürlicher Dateilöschung

The primary impact of CVE-2025-9693 is the ability for an authenticated attacker to delete files on the WordPress server. While the vulnerability requires authentication (Subscriber level or higher), this is a relatively low barrier to entry for many WordPress installations. The most severe consequence arises when attackers delete critical files such as wp-config.php, which contains database credentials and other sensitive configuration information. Deletion of this file can effectively grant the attacker complete control over the WordPress site and potentially the underlying server. The ability to delete other files could also lead to denial of service or the modification of website content. This vulnerability shares similarities with other file access vulnerabilities where insufficient validation allows for unauthorized file manipulation.

WordPress websites utilizing the User Meta – User Profile Builder and User management plugin, particularly those with Subscriber-level users or higher who have access to user management functionalities, are at risk. Shared hosting environments where users have limited control over file permissions are also particularly vulnerable, as are WordPress installations with outdated plugins and weak security configurations.

• wordpress / plugin:

wp plugin list --status=inactive | grep 'user-meta'

• wordpress / plugin:

wp plugin update --all

• wordpress / server:

find /var/www/html/wp-content/plugins/user-meta/ -type f -name '*.php' -print0 | xargs -0 grep -i 'postInsertUserProcess'

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/user-meta/ | grep 'Server'

1. 2025-09-11Disclosure

   disclosure

2. 2025-09-11Patch

   patch

1. Reserviert2025-08-29
2. Veröffentlicht2025-09-11
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-9693 is to immediately upgrade the User Meta – User Profile Builder and User management plugin to version 3.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While a direct WAF rule to prevent file deletion is difficult without specific knowledge of the vulnerable endpoint, restricting file access permissions on the server to the WordPress user can limit the potential damage. Regularly review file permissions and ensure that the WordPress user has only the necessary access rights. Monitor WordPress logs for suspicious file deletion attempts. After upgrading, confirm the fix by attempting to access a non-existent file through the vulnerable endpoint; the request should now return a 403 Forbidden error.