CVE-2026-95525: WP User Frontend Path Traversal Vulnerability

CVE-2026-95525 Overview

CVE-2026-95525 is an arbitrary file deletion vulnerability in the WP User Frontend WordPress plugin affecting versions 4.3.11 and earlier. The flaw allows an authenticated user with the Subscriber role to delete arbitrary files on the underlying web server. The issue is classified as a path traversal weakness under CWE-22.

Deleting critical files such as wp-config.php can trigger the WordPress installation routine, allowing an attacker to reconfigure the site against a database they control. This escalates a file deletion primitive into full site takeover.

Critical Impact
Authenticated Subscribers can delete arbitrary files on the WordPress host, which can be leveraged to compromise the entire site by removing wp-config.php.

Affected Products

WP User Frontend WordPress plugin versions <= 4.3.11
WordPress sites permitting Subscriber-level registration with the plugin active
Multisite installations exposing the plugin's file management endpoints

Discovery Timeline

2026-09-23 - CVE-2026-95525 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95525

Vulnerability Analysis

WP User Frontend exposes file management functionality that fails to validate the file path supplied by authenticated users. A request originating from a low-privilege Subscriber account can traverse outside the intended upload directory and target arbitrary paths on the filesystem. The affected code path removes files without verifying ownership or restricting the target to plugin-managed uploads.

An attacker who deletes wp-config.php forces WordPress into the initial setup flow. From there, the attacker can point the site at an attacker-controlled database and gain administrator access. Deleting other files, such as .htaccess or theme templates, can disrupt access controls and produce denial-of-service conditions.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The plugin accepts a user-controlled file identifier and passes it to a filesystem delete operation without canonicalization or allow-list validation. This is a classic path traversal weakness [CWE-22].

Attack Vector

Exploitation requires network access to the WordPress site and a valid Subscriber account. WordPress sites permitting open registration therefore have no meaningful barrier to abuse. The attacker submits a crafted request to the plugin's file deletion endpoint with a traversal sequence resolving to a sensitive file outside the plugin's upload scope.

See the Patchstack vulnerability report for additional technical context.

Detection Methods for CVE-2026-95525

Indicators of Compromise

Unexpected absence of wp-config.php, .htaccess, or theme and plugin files on the WordPress host
WordPress reverting to the initial installation wizard without administrator action
POST requests from Subscriber accounts to WP User Frontend AJAX endpoints containing ../ sequences or absolute paths in file identifier parameters

Detection Strategies

Inspect web server access logs for admin-ajax.php requests referencing WP User Frontend file actions issued by non-privileged users
Correlate authentication events for Subscriber accounts with subsequent file removal on disk
File integrity monitoring on the WordPress document root to alert on deletion of core configuration or plugin files

Monitoring Recommendations

Enable WordPress audit logging plugins to record file deletion actions triggered through WP User Frontend
Forward web server and WordPress logs to a centralized platform such as Singularity Data Lake for cross-source correlation and retention
Alert on any process writing or removing wp-config.php outside of scheduled maintenance windows

How to Mitigate CVE-2026-95525

Immediate Actions Required

Upgrade WP User Frontend to a version above 4.3.11 as soon as the vendor publishes a fixed release
Disable open user registration or restrict Subscriber registration to trusted email domains until patched
Audit existing Subscriber accounts and remove any that cannot be attributed to a legitimate user

Patch Information

Refer to the Patchstack advisory for the latest patched version and vendor guidance. Apply the vendor update through the WordPress plugin manager and validate the installed version reports higher than 4.3.11.

Workarounds

Deactivate WP User Frontend until the patched release is deployed if Subscriber registration cannot be disabled
Apply a web application firewall rule blocking traversal sequences in file identifier parameters of WP User Frontend endpoints
Set restrictive filesystem permissions on wp-config.php and other core files to prevent removal by the web server user where operationally feasible

bash

# Restrict wp-config.php permissions to reduce deletion risk
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php

# Verify installed plugin version
wp plugin get wp-user-frontend --field=version