CVE-2025-7846High· 8.8▾ TwilightThe WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-10831Critical· 9.1DB-GPT Absolute Path Traversal vulnerability
CVE-2024-10833Critical· 9.1DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
CVE-2025-34392Critical· 9.8Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application
CVE-2025-67898Medium· 4.5MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files
CVE-2026-83784High· 8.8Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
CVE-2026-83746High· 8.1Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.