A path traversal vulnerability in the weDevs WP User Frontend plugin allows authenticated subscribers to delete arbitrary files, potentially causing a denial of service.

The plugin contains a path traversal flaw (CWE-22) that fails to properly sanitize user input, allowing an authenticated subscriber to delete files from the underlying filesystem.

Successful exploitation of this vulnerability could lead to significant system instability or service disruption, as an attacker could delete critical configuration or system files. With a CVSS score of 6.5, this is classified as a medium-severity issue, though the potential for service interruption poses a notable operational risk to business continuity.

Immediate Action: Update the WP User Frontend plugin to version 4.3.12 or the latest available version provided by weDevs.

Proactive Monitoring: Monitor server access logs for suspicious requests involving unusual file paths or directory traversal sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns (e.g., ../) directed at plugin-specific endpoints.

Public Exploit Available: No (exploit_available: unknown)

While this vulnerability requires a registered subscriber account, the potential for destructive file deletion necessitates prompt action. Organizations using the WP User Frontend plugin should prioritize updating to version 4.3.12 immediately to eliminate the underlying path traversal risk and maintain system integrity.