CVE-2025-13320

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.13

Description Insufficient validation of user-supplied file paths in the profile update functionality, combined with improper handling of array inputs by the PHP filter input() function, allows authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. This issue occurs via the current user avatar parameter and can be part of a two-stage attack leading to remote code execution. This only affects sites where the custom avatar setting is enabled.

Recommendations Update WP User Manager to version 2.9.13 or later. Disable the custom avatar setting to mitigate the risk of exploitation.