CVE Alert: CVE-2025-9693 – khaledsaikat – User Meta – User Profile Builder and User management plugin
CVE-2025-9693
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
AI Summary Analysis
Risk verdict
Why this matters
Most likely attack path
Who is most exposed
Detection ideas
- Monitor for authenticated file-deletion events from web server logs tied to user actions, especially from Subscriber+ roles.
- Look for atypical file-delete attempts outside permitted directories, including path traversal-like patterns (../../, etc.).
- Audit access- and error-logs around file-system operations following user management events in the plugin.
- Alert on repeated delete requests targeting configuration or core PHP files.
- Verify plugin version and update activity to identify known-broken instances.
Mitigation and prioritisation
- Patch or upgrade to the fixed release; if unavailable, disable or remove the plugin or restrict Subscriber+ capabilities.
- Enforce least privilege; restrict file-delete permissions for non-admin roles.
- Enable WAF/IPS rules to block path traversal indicators and anomalous file operations.
- Implement robust backups with tested restore procedures and verify integrity after admin actions.
- Incorporate change-management notes for the upgrade and monitor for post-patch anomalies.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
