use strict;
use XML::Rules;

my $filter = XML::Rules->new(style => 'filter', rules => {
    ADD_USER => sub {
        my ($tag, $attrs) = @_;
        delete $attrs->{USER_NAME};
        delete $attrs->{PASSWORD};
        return $tag => $attrs;
    }
});

$filter->filter(\*DATA);

__DATA__
<RIBCL VERSION="2.1">
 <LOGIN USER_LOGIN="Administrator">
  <USER_INFO MODE="write">
  <ADD_USER USER_NAME="John Smith" USER_LOGIN="jsmith" PASSWORD="%user
+_password%">
  </ADD_USER>
  </USER_INFO>
 </LOGIN>
</RIBCL>
[download]

You can of course read from and write to other places than DATA and STDOUT and the good thing is that even if the file is huuuuge, the memory footprint is constant.

If you want to change the tag name as well, just change the return $tag => $attrs; to return 'DEL_USER' => $attrs;