Executive brief
WP User Manager is a WordPress plugin used to manage user profiles and registration. A security flaw allows logged-in users with basic 'Subscriber' permissions to delete arbitrary files from the website's server. This could lead to a complete site failure if critical system files are removed, or allow attackers to bypass security controls by deleting configuration files.
Technical details
The WP User Manager plugin for WordPress (versions up to and including 2.9.16) is vulnerable to arbitrary file deletion due to improper path validation, classified as a path traversal issue (CWE-22). An authenticated attacker with Subscriber-level privileges can exploit this vulnerability to delete files outside of the intended directory. This is achieved by manipulating file paths in requests handled by the plugin. Deleting critical files like wp-config.php can lead to site takeover or permanent denial of service. The issue is resolved in version 2.9.17.
Affected products
- WP User Manager WP User Manager <= 2.9.16
Timeline
- 2026-04-17: other: Vulnerability reported by researcher endy
- 2026-06-05: patched: Patch released in version 2.9.17
- 2026-06-15: advisory: NVD and Patchstack advisory published