A critical path traversal vulnerability in the User Meta plugin allows authenticated attackers to delete arbitrary files, potentially leading to remote code execution.

The plugin contains an improper limitation of a pathname to a restricted directory in the postInsertUserProcess function. This vulnerability allows any authenticated user with at least Subscriber-level access to delete arbitrary files on the underlying server.

This vulnerability poses a significant risk to organizational infrastructure, as the ability to delete arbitrary files can lead to the removal of critical system configuration files, such as wp-config.php, resulting in full site compromise or remote code execution. With a CVSS score of 8.0, this issue is classified as high severity, indicating a substantial risk of service disruption and unauthorized system modification.

Immediate Action: Since a specific patched version is not currently listed, administrators should immediately deactivate and remove the User Meta plugin from their WordPress environments until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for unusual file deletion patterns or requests directed at sensitive configuration files originating from subscriber-level user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and restrict unauthorized access to sensitive system directories.

Public Exploit Available: No

Given the potential for remote code execution via arbitrary file deletion, this vulnerability represents a severe threat to WordPress installations. Security teams must prioritize the immediate removal of the affected plugin until the vendor provides a validated patch, as no other mitigation can reliably prevent this path traversal vector.