Introduction
Attackers with even the lowest level of WordPress access can delete critical files on affected sites, which can lead to full site compromise. The User Meta plugin, a widely used WordPress extension for user profile management, was abruptly closed for download after researchers found a high-severity vulnerability that lets authenticated users delete arbitrary files.
User Meta adds advanced registration, login, and profile management features to WordPress sites. Its user base spans thousands of installations, so this vulnerability reaches a broad segment of the WordPress ecosystem.
Technical Information
CVE-2025-9693 is an arbitrary file deletion vulnerability in the User Meta – User Profile Builder and User management plugin for WordPress, affecting all versions up to and including 3.1.2. The flaw is in the postInsertUserProcess function, which does not properly validate file paths supplied by users. Because of this, attackers with Subscriber-level access or higher can put directory traversal sequences (such as ../) into user input fields that this function processes.
An attacker who exploits the flaw can delete any file on the server that the web server process has permission to remove. The most serious target is wp-config.php, the core WordPress configuration file. Once it is removed, WordPress will prompt for reinstallation, and the attacker can take full administrative control and execute arbitrary code through plugin or theme uploads. Attackers can also delete files such as .htaccess or security plugin files to disable protective measures.
The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The relevant code is in the public plugin source at UserInsert.php#L642.
No patch or fixed version is available as of the plugin's closure on September 10, 2025.
Affected Systems and Versions
- Product: User Meta – User Profile Builder and User management plugin for WordPress
- Affected Versions: All versions up to and including 3.1.2
- Only WordPress installations with this plugin active are vulnerable
- Exploitation requires an authenticated user with Subscriber-level access or higher
Vendor Security History
- WordPress.org closed the User Meta plugin for download on September 10, 2025, due to security concerns
- User feedback describes technical issues and slow or absent support responses
- The vendor has published no patch or official advisory as of this writing
- There is no evidence of a rapid or mature security response process
