What is the CVSS score of CVE-2026-13492?

CVE-2026-13492 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of UsersWP are affected by CVE-2026-13492?

UsersWP WordPress plugin versions 1.2.65 and earlier contain a file deletion vulnerability that allows authenticated Subscriber-level users to delete critical site files including wp-config.php,…

How to fix or mitigate CVE-2026-13492?

Within 24 hours: Audit all WordPress installations for UsersWP plugin versions ≤ 1.2.65; disable Subscriber role file management capabilities or remove user assignment pending remediation. Within 7 days: Either disable the UsersWP plugin entirely or upgrade to the next available version beyond 1.2.65 once released by vendor; implement file-system access controls restricting write permissions on wp-config.php. Within 30 days: Monitor Wordfence and vendor advisories for official patch release; conduct access audit of all Subscriber-level accounts and their actual business justification; deploy Web Application Firewall rules to block directory-traversal patterns in upload handlers.

UsersWP CVE-2026-13492

EUVD-2026-42686 HIGH

Path Traversal (CWE-22)

2026-07-09 security@wordfence.com

GHSA-j69f-3cmp-jrjj

WordPress Path Traversal

8.8

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote, low-complexity, Subscriber-authenticated (PR:L) arbitrary deletion gives I:H/A:H; direct primitive discloses nothing so C:N, unlike the vendor's chain-based C:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 19:36 vuln.today

CVE Published

Jul 09, 2026 - 19:17 nvd

HIGH 8.8

DescriptionCVE.org

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove() AJAX handler building the deletion target from the uploads basedir concatenated with the attacker-controlled metadata value without any realpath canonicalization or uploads-directory boundary check before calling unlink(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server, including wp-config.

AnalysisAI

Arbitrary file deletion in the UsersWP WordPress plugin (versions ≤ 1.2.65) lets authenticated Subscriber-level users delete any file on the server, including wp-config.php, which can escalate into full site takeover. The flaw stems from unsanitized directory-traversal sequences in file-field metadata reaching an unlink() call in the upload_file_remove() AJAX handler. Reported by Wordfence with no public exploit identified at time of analysis and no active-exploitation (KEV) listing; an upstream code fix is available.

Technical ContextAI

The vulnerability lives in AyeCode's UsersWP, a front-end user-registration, profile, and login plugin for WordPress. The root cause is a CWE-22 path traversal: UsersWP_Validation::validate_fields() treats fields of type 'file' by passing them only through WordPress's sanitize_text_field(), which strips tags and control characters but preserves '../' traversal sequences. The tainted metadata value is later consumed by UsersWP_Forms::upload_file_remove(), an AJAX handler that constructs the deletion path by concatenating the WordPress uploads basedir with the attacker-controlled value and calls unlink() without realpath() canonicalization or any check that the resolved path stays inside the uploads directory. Because unlink() runs with the web server's privileges, any file readable/writable by that user is deletable. Affected sink and validation code are visible in tags/1.2.65/includes/class-forms.php (around lines 1059, 1973, 2320-2323) and class-validation.php (line 190).

RemediationAI

Update UsersWP to the first release built from WordPress.org changeset 3590340 / GitHub commit ddb17ad30ff3384cda85c5f372db30b03bd45ac8, which adds proper path handling for file-field deletion; this is an upstream fix available via commit/changeset, and the exact released patched version is not independently confirmed from the provided data - treat the next release after 1.2.65 as the target and verify the fixed version on the plugin changelog before deploying. Until patched, reduce exposure by disabling new user self-registration (or tightening it to trusted users) so the Subscriber-level prerequisite cannot be met, which has the side effect of blocking legitimate sign-ups; alternatively, restrict or block the UsersWP file-remove AJAX action at a WAF or via server rules and back up wp-config.php, understanding that WAF rules on traversal sequences can be bypassed and may break legitimate file-removal functionality. See the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf6390-480f-44e2-ae36-67e3398add33) and the fix changeset (https://plugins.trac.wordpress.org/changeset/3590340/userswp) for details.