CVE-2025-3055
BaseFortify
Publication date: 2025-06-05
Last updated on: 2025-06-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP User Frontend Pro plugin for WordPress has a vulnerability in the delete_avatar_ajax() function that allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. This happens because the plugin does not properly validate file paths before deleting files. Deleting critical files like wp-config.php can lead to remote code execution, allowing attackers to run malicious code on the server.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with low-level authenticated access to delete important files on your server, potentially causing denial of service or enabling remote code execution. This means the attacker could take control of your website or server, leading to data loss, website defacement, or further compromise of your system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the WP User Frontend Pro plugin to a version later than 4.1.3 where the arbitrary file deletion vulnerability in the delete_avatar_ajax() function is fixed. Ensure that only trusted users have Subscriber-level access or higher, and consider restricting or monitoring file deletion operations on the server. Additionally, review and apply any security patches or updates provided by the plugin maintainers.