CVE-2025-3520 is a path traversal vulnerability in the Avatar WordPress plugin (versions up to 0.1.4) that permits authenticated attackers with low privileges (Subscriber-level and above) to delete arbitrary files on the server. The root cause is insufficient validation of file paths in a plugin function, enabling attackers to escape restricted directories. This arbitrary file deletion can facilitate remote code execution if critical files like wp-config.php are removed or manipulated. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1 (Network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact). No patch or remediation guidance is currently available from the vendor or other sources.

An attacker with authenticated access at Subscriber level or higher can delete arbitrary files on the server hosting the vulnerable plugin. This can disrupt website availability and integrity, and potentially lead to remote code execution if key files such as wp-config.php are deleted. The impact includes high integrity and availability damage but no direct confidentiality loss is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin usage to trusted users only and consider removing or disabling the Avatar plugin if possible. Monitor for updates from the vendor wonderboymusic regarding an official fix or patch.