CVE-2025-3055 is a path traversal vulnerability (CWE-22) in the WP User Frontend Pro WordPress plugin. The issue arises from insufficient validation of file paths in the delete_avatar_ajax() function, allowing authenticated users with low privileges (Subscriber-level and above) to delete arbitrary files on the server. This improper limitation of pathname access can lead to deletion of critical files, potentially enabling remote code execution. The vulnerability affects all versions up to and including 4.1.3. There is no vendor-provided patch or advisory linked in the data, and no known exploits in the wild have been reported as of the published date.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can disrupt site availability and integrity. Deletion of sensitive files like wp-config.php can lead to remote code execution, escalating the impact from file deletion to full system compromise. The vulnerability thus poses a high risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to file deletions. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor communications closely for updates on patches or official mitigations.