The WP User Manager plugin for WordPress contains an Arbitrary File Deletion vulnerability (CWE-73) in all versions up to and including 2.9.12. The flaw arises from insufficient validation of the 'current_user_avatar' parameter in the profile update functionality, combined with PHP's filter_input() function mishandling array inputs. Authenticated attackers with Subscriber-level privileges or higher can exploit this vulnerability on sites with the custom avatar feature enabled to delete arbitrary files on the server. This attack requires no user interaction but has a high attack complexity. The vulnerability could be leveraged in a two-stage attack to achieve remote code execution. No patch or official fix information is provided, and no known exploits are reported.

Successful exploitation allows an authenticated user with low privileges to delete arbitrary files on the server hosting the WordPress site. This can lead to denial of service or facilitate further attacks such as remote code execution. The vulnerability does not directly impact confidentiality but has a high impact on integrity and availability. The attack complexity is high, and no user interaction is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the custom avatar setting in the WP User Manager plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.