WordPress User Extra Fields

WordPress User Extra Fields has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 7 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 4 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Path Traversal, behind 3 of the records (38%). Other recurring categories include Missing Authorization, Absolute Path Traversal.

7 of the records (88%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, most of them (4) reported by Phat RiO.

Strategic Overview

Avg CVSSHigh

8.4/ 10

Patch Coverage88%

Open

Fixed

Get automatic notifications for all WordPress User Extra Fields vulnerabilities before they are exploited.

Most severe open issueCVSS 8.1CVE-2025-69377

User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

8 records


2026-02-09 00:00	User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting WordPress User Extra Fields <= 16.8	`CVE-2025-67991`	7.2 High	Phat RiO	Yes
2026-02-05 00:00	User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion WordPress User Extra Fields <= 17.0	`CVE-2025-69377`	8.1 High	Phat RiO	No
2026-02-05 00:00	User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion WordPress User Extra Fields <= 17.0	`CVE-2025-69376`	9.8 Critical	Phat RiO	Yes
2025-12-15 00:00	User Extra Fields <= 16.8 - Missing Authorization WordPress User Extra Fields <= 16.8	`CVE-2025-67579`	5.3 Medium	Phat RiO	Yes
2025-10-30 18:34	WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function WordPress User Extra Fields <= 16.7	`CVE-2025-7846`	8.8 High	Tonn	Yes
2024-11-12 00:00	WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation WordPress User Extra Fields <= 16.6	`CVE-2024-10800`	8.8 High	Tonn	Yes
2024-11-12 00:00	WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion WordPress User Extra Fields <= 16.6	`CVE-2024-11150`	9.8 Critical	Chloe Chamberland	Yes
2024-11-08 00:00	WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload WordPress User Extra Fields <= 16.5	`CVE-2024-10801`	9.8 Critical	Tonn	Yes

Showing 1–8 of 8 reports