High · 8.6 CVE-2025-69376 EUVD-2025-207963GHSA-8f2p-qrq8-3vpg

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Published Feb 20, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: vanquish Product: User Extra Fields

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

Affected products

Vendor	Product	Affected	Fixed
vanquish	User Extra Fields	≤ 17.0	—

References

https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-17-0-arbitrary-file-deletion-vulnerability?_s_id=cve vdb-entry