On March 24th, 2025, we received a submission for an Arbitrary File Upload and an Arbitrary File Deletion vulnerability in WP User Frontend Pro, a WordPress plugin with an estimated 9,000 active installations. The arbitrary file upload vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. The arbitrary file deletion vulnerability can be used by authenticated attackers to delete arbitrary files, including the wp-config.php file, which can also make a site takeover possible.
The post 9,000 WordPress Sites Affected by Arbitrary File Upload and Deletion Vulnerabilities in WP User Frontend Pro WordPress Plugin appeared first on Wordfence.