UsersWP <= 1.2.75 - Authenticated (Subscriber+) Limited File Deletion via Avatar/Banner Image Crop
- ID
- WPSEC-2026-0048
- Plugin
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (userswp)
- Affected
- all versions before 1.2.76
- Remediation
- Update to 1.2.76 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- UsersWP on WPSec AttackSurface
- Fix released
- Published
Description
The UsersWP plugin for WordPress is vulnerable to limited file deletion via the avatar/banner image crop functionality in all versions up to, and including, 1.2.75. This is due to the process_image_crop() function accepting any image URL under wp-content in the 'uwp_crop' parameter instead of only the file the current user uploaded. The crop writes a thumbnail next to the chosen file and stores it as the user's avatar/banner thumbnail; the next crop, or removal through the upload_file_remove() AJAX handler, then deletes that thumbnail together with the derived original file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users' avatar and banner images and other image files in the uploads directory. Path traversal sequences are stripped, so files outside the uploads directory cannot be deleted.
References
- https://wpsec.com/vuln/WPSEC-2026-0048/
- https://plugins.svn.wordpress.org/userswp/tags/1.2.76/
- https://wordpress.org/plugins/userswp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS