What is the CVSS score of CVE-2026-4977?

CVE-2026-4977 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4977

EUVD-2026-21266 MEDIUM

Missing Authorization (CWE-862)

2026-04-10 Wordfence

GHSA-72hv-q97x-rw7p

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21266

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.

AnalysisAI

Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above to manipulate restricted user metadata fields via the upload_file_remove() AJAX handler, bypassing field-level permissions intended to restrict modifications to administrator-only fields. The vulnerability stems from insufficient validation of the $htmlvar parameter against allowed fields or admin-use restrictions, enabling attackers to clear or reset sensitive usermeta columns on their own user records.

Technical ContextAI

The UsersWP plugin provides front-end user management functionality for WordPress including login, registration, and profile editing. The vulnerability exists in the upload_file_remove() AJAX handler within the class-forms.php file, where user input specifying which metadata field to remove is not validated against a whitelist of permissible fields or checked against the for_admin_use property that designates certain fields as administrator-only. This is a classic access control bypass rooted in CWE-862 (Missing Authorization), where permission checks are insufficient or absent. The affected product is identified via CPE as cpe:2.3:a:stiofansisland:userswp_-_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp:*:*:*:*:*:*:*:*, indicating all versions are potentially affected up to the patched release.

RemediationAI

Site administrators should immediately upgrade the UsersWP plugin to version 1.2.59 or later, which contains the fix for improper access control validation. The patch implements proper field-level permission validation by adding whitelist checks and for_admin_use property verification to the upload_file_remove() AJAX handler, preventing authenticated users from modifying fields restricted to administrators. During the upgrade window, administrators may temporarily restrict subscriber-level account creation or disable the UsersWP front-end file upload functionality via plugin settings if a delay in patching is unavoidable. For detailed patch information and technical remediation guidance, refer to the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006 and the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59.