CVE-2025-13320: 
WordPress vulnerability analysis and mitigation

CVE-2025-13320 is an Arbitrary File Deletion vulnerability in the WP User Manager plugin for WordPress, affecting all versions up to and including 2.9.12. The flaw resides in the profile update functionality and can be exploited by authenticated attackers with Subscriber-level access or above to delete arbitrary files on the server, potentially enabling remote code execution. It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 6.8 (High) (Wordfence, Red Hat CVE). Exploitation is only possible on sites where the custom avatar setting is enabled.

The root cause is classified as CWE-73 (External Control of File Name or Path), with path traversal characteristics (CWE-22). The vulnerability stems from two compounding weaknesses: insufficient validation of user-supplied file paths in the profile update functionality (trait-wpum-account.php, lines ~70–86) and improper handling of array inputs by PHP's filter_input() function, which can be bypassed by supplying an array instead of a scalar value (Wordfence, EUVD). An attacker manipulates the current_user_avatar parameter during a profile update to reference arbitrary server-side file paths, which the plugin then deletes without proper sanitization. The attack is two-stage: first uploading a file to learn its path, then leveraging the deletion primitive to remove critical files (e.g., wp-config.php) to facilitate further compromise.

Successful exploitation allows an authenticated attacker to delete arbitrary files on the web server, including critical WordPress configuration files such as wp-config.php. Deleting wp-config.php can force WordPress into a re-installation state, enabling an attacker to reconfigure the site with attacker-controlled database credentials and achieve remote code execution. This results in high integrity and availability impact, with potential for full site takeover and lateral movement within the hosting environment (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.0022 (0.22%), indicating a low near-term exploitation probability (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least Subscriber-level privileges and the custom avatar feature to be enabled, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability was detected by Qualys (detection ID 530786) (Qualys).

1. Reconnaissance: Identify WordPress sites running WP User Manager ≤ 2.9.12 with the custom avatar setting enabled. This can be done by checking plugin version disclosures in page source or using tools like WPScan.
2. Obtain Subscriber Access: Register or log in as a low-privileged user (Subscriber or above) on the target WordPress site.
3. Upload a File: Submit a profile update with a legitimate avatar upload to understand the server's file storage path structure and confirm the custom avatar feature is active.
4. Craft Malicious Request: Submit a second profile update request, manipulating the current_user_avatar POST parameter to supply an array value (bypassing PHP's filter_input() scalar check) containing a path-traversal sequence pointing to a critical file (e.g., ../../../../wp-config.php).
5. Trigger File Deletion: The plugin processes the manipulated parameter without adequate path validation and deletes the targeted file from the server.
6. Achieve Remote Code Execution: With wp-config.php deleted, WordPress enters setup mode. The attacker navigates to the WordPress installation wizard, supplies attacker-controlled database credentials, and gains administrative control, enabling arbitrary PHP code execution (Wordfence, Infinitsec).

• Network: Unusual POST requests to WordPress profile update endpoints (e.g., /account/ or similar WPUM account pages) containing array-formatted current_user_avatar parameters or path traversal sequences (../) in request bodies.
• Logs: Web server access logs showing repeated profile update submissions from the same authenticated user in short succession; HTTP 200 responses to profile update requests followed by WordPress setup/install page access (/wp-admin/setup-config.php or /wp-admin/install.php).
• File System: Unexpected absence of wp-config.php or other critical WordPress core files; new or modified wp-config.php with unfamiliar database credentials; unexpected web shells in the WordPress root or plugin directories.
• Process: PHP processes spawning unexpected child processes (e.g., shell commands) from the web server user account after a profile update event.

Users should update the WP User Manager plugin to version 2.9.13 or later, which contains the fix for this vulnerability (Wordfence). As an interim workaround, site administrators can disable the custom avatar setting in the WP User Manager plugin settings, which removes the attack vector entirely. Additionally, restricting user registration or limiting Subscriber-level account creation reduces exposure until patching is complete.

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability digest for December 8–14, 2025, highlighting it among notable plugin flaws (Wordfence Blog). Qualys included it in their December 2025 application security detections roundup (Qualys). No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been observed.