CVE-2025-13320
WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled.
| CWE | CWE-73 |
| Vendor | wpusermanager |
| Product | wp user manager – user profile builder & membership |
| Published | Dec 12, 2025 |
| Last Updated | Apr 8, 2026 |
Get instant alerts for wpusermanager wp user manager – user profile builder & membership
Be the first to know when new medium vulnerabilities affecting wpusermanager wp user manager – user profile builder & membership are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H