CVE-2025-13320

The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled.

• CWE-73

• https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L70
• https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L75
• https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L86
• https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/includes/forms/trait-wpum-account.php#L70
• https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/includes/forms/trait-wpum-account.php#L75
• https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/includes/forms/trait-wpum-account.php#L86
• https://plugins.trac.wordpress.org/changeset/3420956/wp-user-manager/trunk/includes/forms/trait-wpum-account.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8304bf-bec2-4fcf-9fe2-46b626b3dae9?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13315Twonky Server 8.5.2 on Linux and Windows is vulnerable to an…9.8
• CVE-2025-13316Twonky Server 8.5.2 on Linux and Windows is vulnerable to a …8.1
• CVE-2025-13317The Appointment Booking Calendar plugin for WordPress is vul…5.3
• CVE-2025-13318The Booking Calendar Contact Form plugin for WordPress is vu…5.3
• CVE-2025-13319An injection vulnerability has been discovered in the API fe…8.8
• CVE-2025-1332A vulnerability has been found in FastCMS up to 0.1.5 and cl…4.8
• CVE-2025-13321Mattermost Desktop App versions <6.0.0 fail to sanitize sens…3.3
• CVE-2025-13322The WP AUDIO GALLERY plugin for WordPress is vulnerable to a…8.1
• CVE-2025-13323A security flaw has been discovered in code-projects Simple …9.8
• CVE-2025-13324Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10…3.7
• CVE-2025-13325A vulnerability was determined in itsourcecode Student Infor…8.8
• CVE-2025-13326Mattermost Desktop App versions <6.0.0 fail to enable the Ha…3.9