WP User Frontend Pro Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the WP User Frontend Pro plugin for WordPress, affecting all versions through 4.1.3. The issue arises from inadequate file path validation in the delete_avatar_ajax() function. This vulnerability enables authenticated attackers with Subscriber-level access or higher to delete arbitrary files from the server. Deleting certain files, such as wp-config.php, could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, with the potential for remote code execution if a critical file is removed.

Remediation

Users are advised to update to WP User Frontend Pro version 4.1.4 or a later patched version.