CVE-2026-49766: WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability

Synopsis

An arbitrary file deletion vulnerability affects the WP User Manager WordPress plugin in versions 2.9.16 and below. The flaw is reachable over the network by any authenticated user holding a subscriber-level account, with no additional privileges or victim interaction required. Successful exploitation lets an attacker delete arbitrary files on the server, which in practice enables complete site takeover by removing critical WordPress configuration files and triggering a reinstallation flow. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege subscriber-level account is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  The attacker can trigger file deletion entirely on their own without any action from another user or an administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental setup are required.

Blast Radius

• Deletes arbitrary files on the server filesystem, including wp-config.php, forcing a WordPress reinstallation flow that an attacker can hijack to gain full administrative control.
• Removes theme, plugin, or upload files, causing immediate site outage and potential permanent data loss for stored media and assets.
• Eliminates security-sensitive files such as .htaccess rules or certificate material, stripping server-level access controls and exposing additional attack surface.
• Because the CVSS scope is Changed, impact can extend beyond the WordPress application itself to other services or files sharing the same server filesystem.