CVE-2025-69376
Published: 20 February 2026
Summary
CVE-2025-69376 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69376 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified under CWE-22, in the WordPress plugin User Extra Fields (wp-user-extra-fields) developed by vanquish. This issue affects all versions from n/a through 17.0 inclusive. The vulnerability was published on 2026-02-20 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
An unauthenticated attacker can exploit this path traversal flaw over the network with low attack complexity and no user interaction required. Exploitation enables arbitrary file deletion on the targeted WordPress site, resulting in significant denial-of-service effects given the changed scope and high availability impact, while confidentiality and integrity remain unaffected.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-17-0-arbitrary-file-deletion-vulnerability?_s_id=cve) describes this as an arbitrary file deletion vulnerability specifically in version 17.0 of the plugin, providing details for security practitioners to assess and address the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207963
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WP plugin enables remote unauthenticated exploitation (T1190) resulting in arbitrary file deletion for availability impact/DoS (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the path traversal vulnerability by requiring timely identification, reporting, and correction of the flaw in the wp-user-extra-fields plugin.
Prevents exploitation of the path traversal by enforcing validation of untrusted inputs, such as pathnames, to ensure they do not traverse to restricted directories.
Boundary protection with web application firewalls can inspect and block path traversal payloads targeting the vulnerable WordPress plugin endpoint.