What is the CVSS score of EUVD-2026-37860?

EUVD-2026-37860 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

UsersWP EUVD-2026-37860

| CVE-2026-12102 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-18 Wordfence

GHSA-crv8-pwhc-5w5p

WordPress Authentication Bypass Userswp Front End Login Form User Registration User Profile Members Directory Plugin For Wp Wordpress Plugin Stiofansisland

2.7

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Editor-level authentication required (PR:H); sole impact is image metadata deletion (I:L), with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 08:06 vuln.today

Analysis Generated

Jun 18, 2026 - 08:06 vuln.today

DescriptionCVE.org

The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.

AnalysisAI

Insecure Direct Object Reference in the UsersWP WordPress plugin (versions through 1.2.63) allows authenticated editor-level users to permanently delete or reset the avatar and banner images of any WordPress user account, including site administrators, by supplying an arbitrary user_id parameter. The vulnerability lies in missing authorization validation on the user_id key within image management handlers across class-forms.php, class-userswp.php, and class-profile.php, directly manipulating the uwp_usermeta table. No public exploit has been identified at time of analysis, and real-world severity is constrained by the high-privilege authentication prerequisite.

Technical ContextAI

The affected component is the UsersWP plugin for WordPress (CPE: cpe:2.3:a:stiofansisland:userswp_-_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Through User-Controlled Key): the plugin's image reset and delete functions in class-forms.php (lines 89, 371, 389), class-userswp.php (line 574), and class-profile.php (line 1739) accept a user-supplied user_id parameter and use it to directly locate and clear avatar_thumb or banner_thumb metadata rows in the uwp_usermeta custom database table, without verifying that the authenticated user is authorized to modify the targeted account. This is a classic IDOR pattern where an object reference (user_id) is trusted without an ownership or permission check against the session context.

RemediationAI

An upstream fix has been committed to the AyeCode GitHub repository at https://github.com/AyeCode/userswp/commit/0e69f967578904cc26fadd0206270d50b7420298; however, the specific released patched plugin version number is not independently confirmed from available data - administrators should update to the latest version available in the WordPress plugin repository and verify it includes or supersedes this commit. As a compensating control until patching is confirmed, restrict editor-role assignments exclusively to fully trusted personnel, since the vulnerability requires editor-level WordPress authentication. Auditing existing editor accounts for necessity is advisable. Disabling front-end profile image upload/delete functionality via plugin settings, if available, would eliminate the attack surface with the trade-off of removing that feature for all users.