CVE-2026-19991
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The UsersWP plugin for WordPress (versions up to and including 1.2.70) is vulnerable to Arbitrary File Deletion via the upload_file_remove() AJAX handler. An authenticated attacker with Subscriber-level access or above can delete arbitrary files on the server, including wp-config.
Risk Assessment
An attacker with low privileges can delete critical files such as wp-config.php, potentially leading to complete site destruction or data exposure.
Recommendation
Update the plugin to a version newer than 1.2.70 or disable it if no fix is available.
Other vulnerabilities in UsersWP
See all- CVE-2026-94641High
The UsersWP plugin for WordPress (up to version 1.2.73) is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
- CVE-2026-103086Medium
The UsersWP plugin for WordPress up to version 1.2.74 contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured access control.
- CVE-2026-86814High
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
- CVE-2026-18501Medium
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-13492High
The UsersWP plugin for WordPress up to version 1.2.65 is vulnerable to arbitrary file deletion. This is due to insufficient validation of file fields in the UsersWP_Validation::validate_fields() function and lack of path canonicalization in the UsersWP_Forms::upload_file_remove() AJAX handler, allowing deletion of any file on the server.
- CVE-2025-67593Medium
The UsersWP plugin (versions up to and including 1.2.48) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
- CVE-2025-66072Medium
The UsersWP (userswp) plugin up to version 1.2.47 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS