PT-2025-44583 · WordPress · Wordpress User Extra Fields

Tonn · Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-7846

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields versions up to and including 16.7

Description The WordPress User Extra Fields plugin is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the save fields() function. Authenticated attackers with Subscriber-level access or higher can exploit this to delete arbitrary files on the server. Deletion of critical files, such as wp-config.php, could lead to remote code execution.

Recommendations Versions up to and including 16.7 should be updated to a newer, fixed version when available. As a temporary workaround, consider restricting access to the save fields() function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-7846

Affected Products

Wordpress User Extra Fields

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-7846 · Security Note
• https://twitter.com/CveFindCom/status/1984193525580247392 · Twitter Post
• https://twitter.com/CveTodo/status/1984161489142284627 · Twitter Post
• https://t.me/CVEtracker/36266 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c66d0fb4-e2df-4bdb-8ccb-18a96173a55d?source=cve · Note
• https://twitter.com/CVEnew/status/1984166107754983830 · Twitter Post
• https://twitter.com/RedPacketSec/status/1984200165083762805 · Twitter Post
• https://codecanyon.net/item/user-extra-fields/12949844 · Note
• https://twitter.com/VulmonFeeds/status/1984190960222249142 · Twitter Post
• https://t.me/cveNotify/141080 · Telegram Post