High · published October 31, 2025
🚨 If you're using the WordPress User Extra Fields plugin, brace yourself! A flaw in the save_fields() function is allowing authenticated users to delete any file on your server. 🔥 Think of it like a bakery where a customer with a simple loyalty card is suddenly allowed to throw away any pastry they choose— including the prized secret recipe! That’s the kind of access this flaw grants to malicious users. An attacker with just Subscriber-level access can wipe out essential files, like your wp-config.php. This could lead to total chaos, allowing them to execute arbitrary code on your server, potentially bringing your entire site down. Absolutely devastating!
Think of it like a bakery where a customer with a simple loyalty card is suddenly allowed to throw away any pastry they choose— including the prized secret recipe! That’s the kind of access this flaw grants to malicious users. The vulnerability arises from insufficient file path validation in the save_fields() function. This oversight permits authenticated users to delete any file on the server, which can lead to severe remote code execution risks.
An attacker with just Subscriber-level access can wipe out essential files, like your wp-config.php. This could lead to total chaos, allowing them to execute arbitrary code on your server, potentially bringing your entire site down. Absolutely devastating! Update the User Extra Fields plugin to version 16.8 or later immediately. Audit your user roles to ensure that only trusted users have Subscriber-level access and review file permissions on your server. 🛡️ You've got this! With these steps, you'll turn this threat into a thing of the past! 🦸