An authenticated arbitrary file deletion vulnerability in the UsersWP plugin for WordPress allows attackers with Subscriber-level access to compromise system integrity by deleting critical server files.

This is a path traversal flaw (CWE-22) residing in the upload_file_remove() AJAX handler. By injecting crafted traversal sequences that bypass sanitization, an attacker with Subscriber-level access can manipulate file paths to delete arbitrary files on the server, including wp-config.php.

The ability to delete arbitrary files on the web server poses a significant risk to business continuity and data security. An attacker could delete the wp-config.php file to induce a site-wide denial of service or potentially delete configuration files to facilitate further exploitation. Given the CVSS score of 8.1, this vulnerability represents a high-severity threat that could lead to complete site disruption.

Immediate Action: Update the UsersWP plugin to version 1.2.71 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor server logs for suspicious AJAX requests to the upload_file_remove function, particularly those containing path traversal patterns like double dots.

Compensating Controls: If an immediate update is not possible, employ a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences or unauthorized access to sensitive file paths.

Public Exploit Available: Unknown

This vulnerability presents a high risk to WordPress environments due to the potential for critical system file deletion by low-privileged users. Administrators must prioritize updating the UsersWP plugin to version 1.2.71 as soon as possible. Failure to patch may allow unauthorized actors to disrupt site operations or manipulate the server environment, necessitating immediate action.