EUVD-2026-37860
GHSA-crv8-pwhc-5w5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain editor-level WordPress credentials
-
DeliveryEnumerate target administrator's user_id
-
ExploitCraft POST request with arbitrary user_id to UsersWP image reset endpoint
-
ExecutionPlugin skips authorization check on user_id key
-
PersistClear avatar_thumb and banner_thumb in uwp_usermeta
-
ImpactTarget user's profile images permanently deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with editor-level privileges or above, as confirmed by PR:H in the CVSS vector. The UsersWP plugin must be installed and active on the target site. The attacker must know or enumerate the numeric user_id of the target account, which is often trivially discoverable via WordPress author archive URLs or the admin panel. The impact is strictly limited to permanent deletion of profile avatar and banner images - no data disclosure, no code execution, and no broader account compromise occurs. Exploitation does not require any non-default plugin configuration; the vulnerable code paths are active whenever the plugin is installed. The editor-level authentication requirement is the primary limiting factor, restricting exploitation to trusted-but-malicious or compromised internal accounts. |
| Impact | The NVD CVSS 2.7 (Low) score accurately characterizes limited real-world risk. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N confirms network reachability with no attack complexity, but the PR:H metric is decisive: exploitation requires a valid editor-level (or higher) WordPress credential. There is no confidentiality impact and no availability impact - the sole effect is permanent deletion of another user's profile image, a low-impact integrity violation. No KEV listing and no public exploit identified at time of analysis further support deprioritization. The primary realistic threat actor is a disgruntled or compromised internal editor account targeting administrator profiles. For most organizations this is a low-priority finding, though sites with many untrusted editors or strict profile image integrity requirements should patch promptly. |
| Exploit ScenarioDerived | An attacker with a valid WordPress editor account logs into a target site running UsersWP through version 1.2.63. They identify an administrator's numeric user_id (readily available through the WordPress admin interface or public author pages) and submit a crafted request to the UsersWP image reset or delete endpoint supplying the administrator's user_id. The plugin processes the request without verifying the editor's permission to modify that account, permanently clearing the administrator's avatar_thumb and banner_thumb metadata from the uwp_usermeta table. No public exploit code has been identified, and the attack requires a pre-existing editor-level credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-level users to permanently delete or reset the avatar and banner images of any WordPress user account, including site administrators, by supplying an arbitrary user_id parameter. The vulnerability lies in missing authorization validation on the user_id key within image management handlers across class-forms.php, class-userswp.php, and class-profile.php, directly manipulating the uwp_usermeta table. No public exploit has been identified at time of analysis, and real-world severity is constrained by the high-privilege authentication prerequisite.
RemediationAI
An upstream fix has been committed to the AyeCode GitHub repository at https://github.com/AyeCode/userswp/commit/0e69f967578904cc26fadd0206270d50b7420298; however, the specific released patched plugin version number is not independently confirmed from available data - administrators should update to the latest version available in the WordPress plugin repository and verify it includes or supersedes this commit. As a compensating control until patching is confirmed, restrict editor-role assignments exclusively to fully trusted personnel, since the vulnerability requires editor-level WordPress authentication. Auditing existing editor accounts for necessity is advisable. Disabling front-end profile image upload/delete functionality via plugin settings, if available, would eliminate the attack surface with the trade-off of removing that feature for all users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the UsersWP plugin for WordPress (CPE: cpe:2.3:a:stiofansisland:userswp_-_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Through User-Controlled Key): the plugin's image reset and delete functions in class-forms.php (lines 89, 371, 389), class-userswp.php (line 574), and class-profile.php (line 1739) accept a user-supplied user_id parameter and use it to directly locate and clear avatar_thumb or banner_thumb metadata rows in the uwp_usermeta custom database table, without verifying that the authenticated user is authorized to modify the targeted account. This is a classic IDOR pattern where an object reference (user_id) is trusted without an ownership or permission check against the session context.
Know when Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Editor-level authentication required (PR:H); sole impact is image metadata deletion (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
View allArbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above
Exploit-DB