WordPress User Extra Fields Plugin Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WordPress User Extra Fields plugin, specifically in versions through 17.0. This vulnerability allows for improper limitation of a pathname, potentially leading to arbitrary file deletion. Such deletion could disrupt website functionality by removing essential core files.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the affected WordPress site. If critical core files are removed, it may cause the website to malfunction or become nonoperational.

Remediation

Users are advised to mitigate this vulnerability immediately. Patchstack has provided a mitigation rule to block potential attacks until an official patch is available. For more information on how to apply this mitigation, visit the Patchstack website.