UsersWP Plugin CVE-2026-19991

The target site must have the UsersWP plugin installed and active at version 1.2.70 or earlier. Exploitation requires an authenticated WordPress account with at minimum Subscriber-level access; on sites using UsersWP for membership or community functionality - its primary use case - open public registration is the default, allowing an attacker to self-provision a qualifying account. The WordPress AJAX endpoint (wp-admin/admin-ajax.php) handling upload_file_remove must be network-reachable, which is standard for any public-facing WordPress installation. No non-default plugin configuration or special deployment mode is required beyond the plugin being active. Exploitation is limited to file deletion (no read or overwrite); the attacker must specify the relative target path, though well-known WordPress paths such as wp-config.php are trivially guessable. The theoretical confidentiality boundary of C:N in the CVSS vector may not fully account for wp-config.php exposure during the deletion window.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-supported by the vulnerability mechanics. Attack complexity is genuinely low once the crafted token format is understood, and Subscriber-level registration is typically open to the public on membership and community sites - the primary deployment context for UsersWP - making the effective privilege barrier minimal in practice. The C:N metric may technically understate real-world impact: deleting wp-config.php exposes database credentials in plaintext to any co-located process that reads the file before deletion, introducing a secondary confidentiality dimension not captured by the vector. EPSS data is absent from the input and cannot be assessed. No KEV listing or confirmed POC exists at time of analysis, but the Wordfence advisory's direct source-code references to class-forms.php:2432, misc.php:2107, and class-validation.php:194 provide sufficient technical specificity to accelerate exploit development. The fix exists in SVN trunk (changeset 3650759) but no tagged release version is independently confirmable, meaning sites relying on the WordPress.org auto-update channel may not yet be patched.

An attacker self-registers a free Subscriber account on a WordPress membership site running UsersWP ≤ 1.2.70 - a common configuration for community portals. They submit a crafted account 'file' field containing the uploads base URL embedded within a token (e.g., 'http://example.com/wp-content/uploads..http://example.com/wp-content/uploads/../../wp-config.php'), which passes the validate_file() check because no literal '../' is present. On a subsequent AJAX call to upload_file_remove(), uwp_get_file_relative_url() collapses the embedded token into a directory traversal sequence, and wp_delete_file() removes wp-config.php from the server, taking the WordPress site offline. No confirmed public POC exists at time of analysis, though the Wordfence source-level write-up provides sufficient detail to reconstruct the technique.