Arbitrary File Deletion Vulnerability in Avatar Plugin for WordPress

CVE-2025-3520

What is CVE-2025-3520?

The Avatar plugin for WordPress has a security flaw that allows authenticated users with Subscriber-level access and above to delete arbitrary files from the server. This vulnerability arises from insufficient file path validation in a core function, exposing the system to significant risk, including the potential for remote code execution if critical files such as wp-config.php are deleted. All versions up to and including 0.1.4 are affected.

References