What is the CVSS score of EUVD-2026-21649?

EUVD-2026-21649 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP EUVD-2026-21649

| CVE-2026-4979 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-11 Wordfence

PHP SSRF WordPress

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:30 euvd

EUVD-2026-21649

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:25 nvd

MEDIUM 5.0

DescriptionCVE.org

The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.

AnalysisAI

Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and above to force the WordPress server to make arbitrary HTTP requests via the uwp_crop parameter in avatar/banner image crop operations. The vulnerability stems from insufficient URL origin validation in the process_image_crop() method, which accepts user-controlled URLs and passes them to PHP image processing functions that support URL wrappers, enabling internal network reconnaissance and potential access to sensitive services. No public exploit code or active exploitation has been confirmed, though the vulnerability requires only authenticated access and low attack complexity.

Technical ContextAI

The UsersWP plugin processes avatar and banner image cropping through the process_image_crop() method in class-forms.php. This function accepts a user-supplied URL via the uwp_crop POST parameter and performs validation using only esc_url() for sanitization and wp_check_filetype() for extension verification. Neither function enforces that the URL must reference a file within the WordPress local uploads directory. The URL is subsequently passed to uwp_resizeThumbnailImage() in misc.php, which invokes PHP image processing functions including getimagesize() and imagecreatefrom*() functions. These PHP functions inherently support URL wrappers (such as http://, https://, and ftp://) and will automatically follow remote URLs, making HTTP requests to arbitrary destinations specified by the attacker. This is a classic SSRF vulnerability (CWE-918: Server-Side Request Forgery) where the server becomes a proxy for attacker-initiated requests, exposing internal network topology and potentially sensitive services.

RemediationAI

Update the UsersWP plugin to a version later than 1.2.58 that includes the fix implementing strict URL origin validation. A fix has been committed to the upstream repository (commit ca0c81b9c76a26c5ac78a8f3604cf9122a7a4aa1 on GitHub: https://github.com/AyeCode/userswp/commit/ca0c81b9c76a26c5ac78a8f3604cf9122a7a4aa1), which should be available in the next official release. The recommended remediation is to apply the patch version once released by AyeCode/UsersWP. As an interim mitigation on unpatched systems, restrict user registration permissions to trusted administrators only, disable avatar/banner image upload functionality if not required, or implement web application firewall rules to block suspicious POST requests to the plugin's image crop endpoint. Review Wordfence's threat intelligence portal and the official UsersWP GitHub repository for patch availability confirmation.