WordPress: Arbitrary File Deletion via delete_avatar_ajax in WP User Frontend Pro Plugin

In WP User Frontend Pro plugin for WordPress versions up to and including 4.1.3 a high severity vulnerability CVE-2025-3055 was detected. This vulnerability allows authenticated users with Subscriber access or higher to delete arbitrary server files via the delete_avatar_ajax() function, potentially leading to remote code execution if critical files like wp-config.php are removed. To address this issue, users should upgrade WP User Frontend Pro plugin to versions 4.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3055.