The User Meta plugin for WordPress suffers from a CWE-22 path traversal vulnerability in the postInsertUserProcess function, enabling authenticated attackers with low privileges (Subscriber and above) to delete arbitrary files on the server. This occurs because the plugin does not properly validate file paths before deletion, allowing traversal outside intended directories. Exploiting this can lead to remote code execution by deleting key files necessary for WordPress operation, such as wp-config.php. The vulnerability affects all versions up to and including 3.1.2 and is publicly documented with a CVSS 3.1 score of 8. No known exploits in the wild or patches are currently reported.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site. This can cause denial of service or enable remote code execution if critical files like wp-config.php are deleted. The compromise of such files can lead to full site takeover and data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level user permissions where possible and monitor for suspicious file deletion activity. Avoid granting unnecessary privileges to low-level users. Follow vendor updates closely for an official fix.