Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
CVE-2026-4977
|
EUVD-2026-21266
MEDIUM
GHSA-72hv-q97x-rw7p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents moderate real-world risk despite its CVSS 3.1 base score of 4.3 (Low severity). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) correctly reflects that exploitation requires network access, low attack complexity, and low-level authentication (PR:L = subscriber access), with integrity impact limited to the attacker's own user record and no confidentiality or availability impact. However, the practical significance depends on deployment context: in multi-user WordPress sites where subscriber accounts are freely created or where legitimate users have restricted metadata fields defined by administrators, this becomes a meaningful privilege escalation vector allowing subscribers to modify fields marked 'For admin use only.' The absence of public exploit code and non-confirmation of active exploitation (no KEV status provided) suggests this is not an immediate critical threat, but the ease of exploitation (low complexity, no user interaction required) and the authentication bypass nature of the issue make it a legitimate priority for WordPress site administrators, particularly those using UsersWP for role-based user profile restrictions. |
| Exploit ScenarioDerived | An authenticated subscriber on a WordPress site running UsersWP creates a legitimate account and accesses their profile page. By crafting a malicious AJAX request to the upload_file_remove() handler with a $htmlvar parameter pointing to a restricted metadata field marked 'For admin use only' (such as a field controlling their role, verified status, or custom admin-defined attribute), the subscriber bypasses the missing field-level permission check and clears that field on their own user record. Since the attack requires only network access and low-privilege authentication with no user interaction, exploitation is trivial for any account holder, making this a straightforward privilege escalation in deployments where restricted metadata fields enforce important security policies. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Improper access control in UsersWP plugin for WordPress versions up to 1.2.58 allows authenticated subscribers and above to manipulate restricted user metadata fields via the upload_file_remove() AJAX handler, bypassing field-level permissions intended to restrict modifications to administrator-only fields. The vulnerability stems from insufficient validation of the $htmlvar parameter against allowed fields or admin-use restrictions, enabling attackers to clear or reset sensitive usermeta columns on their own user records.
RemediationAI
Site administrators should immediately upgrade the UsersWP plugin to version 1.2.59 or later, which contains the fix for improper access control validation. The patch implements proper field-level permission validation by adding whitelist checks and for_admin_use property verification to the upload_file_remove() AJAX handler, preventing authenticated users from modifying fields restricted to administrators. During the upgrade window, administrators may temporarily restrict subscriber-level account creation or disable the UsersWP front-end file upload functionality via plugin settings if a delay in patching is unavoidable. For detailed patch information and technical remediation guidance, refer to the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006 and the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The UsersWP plugin provides front-end user management functionality for WordPress including login, registration, and profile editing. The vulnerability exists in the upload_file_remove() AJAX handler within the class-forms.php file, where user input specifying which metadata field to remove is not validated against a whitelist of permissible fields or checked against the for_admin_use property that designates certain fields as administrator-only. This is a classic access control bypass rooted in CWE-862 (Missing Authorization), where permission checks are insufficient or absent. The affected product is identified via CPE as cpe:2.3:a:stiofansisland:userswp_-_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp:*:*:*:*:*:*:*:*, indicating all versions are potentially affected up to the patched release.
Know when Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp
View allArbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file
Unauthenticated attackers can recover the shared password protecting UsersWP's 25 built-in dummy user accounts - in all
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers
Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and
Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-l
Exploit-DB