The WordPress User Extra Fields plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to and including 16.7. Authenticated users with Subscriber-level access or higher can exploit this flaw to delete arbitrary files on the server, potentially leading to remote code execution if critical files like wp-config.php are deleted.