Path Traversal Vulnerability in User Extra Fields Plugin by Vanquish
CVE-2025-69377

7.7HIGH

Key Information:

Vendor

WordPress
Status
User Extra Fields
Vendor
CVE Published:
20 February 2026

What is CVE-2025-69377?

The User Extra Fields plugin developed by Vanquish is susceptible to a path traversal vulnerability, which allows an attacker to exploit improperly validated file paths. This flaw facilitates unauthorized access to sensitive files on the server, potentially leading to arbitrary file deletion or exposure of sensitive data. Affected versions include all prior to and including version 17.0, highlighting the critical need for users to update their installations to maintain security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

User Extra Fields <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/wp-user-...
vdb-entry

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO | Patchstack Bug Bounty Program
JSON
.