WP User Frontend Pro: Arbitrary file upload remote code execution (CVE-2025-3054)

The WP User Frontend Pro plugin for WordPress, specifically versions up to and including 4.1.3, contains a vulnerability that allows for arbitrary file uploads. This flaw resides in the upload_files function and requires the "Private Message" module to be enabled within the Business edition of the software. An authenticated attacker with at least Subscriber-level privileges can leverage this to upload malicious files, potentially leading to remote code execution. At the time of reporting, no official patch is documented.

Impact

Successful exploitation allows for remote code execution on the server hosting the WordPress instance. This vulnerability is restricted to environments where the "Private Message" module is active in the Business version of the plugin.

Recommendation

• Audit WordPress environments to determine if the WP User Frontend Pro plugin is installed and running version 4.1.3 or earlier.
• Disable the "Private Message" module within the WP User Frontend Pro plugin configuration as a temporary mitigation until an official patch is released.
• Review WordPress access logs for anomalous file upload attempts by users with "Subscriber" roles or higher.
• Monitor the web server document root for newly created files with suspicious extensions (e.g., .php, .php5, .phtml) uploaded via the plugin's path.