Junglewise Threat Intelligence

CVE-2026-13492: UsersWP plugin arbitrary file deletion via path traversal

CVE-2026-13492 · Severity: high · CVSS 8.8 · Published 2026-07-09

Executive brief

The UsersWP plugin for WordPress, which manages user registration and profiles, contains a security flaw that allows logged-in users to delete files from the web server. By exploiting this vulnerability, an attacker could delete critical system files, such as the site's configuration file, potentially leading to a complete site takeover or a total service outage. This affects all versions of the plugin up to and including 1.2.65.

Technical details

The UsersWP plugin is vulnerable to arbitrary file deletion in versions up to 1.2.65. The root cause is a failure to properly validate and canonicalize file paths in the UsersWP_Validation::validate_fields() function and the UsersWP_Forms::upload_file_remove() AJAX handler. Specifically, the validation logic allows directory-traversal sequences (e.g., ../) to remain in file-field values. When a file removal request is processed, the plugin concatenates the attacker-controlled metadata with the uploads base directory and calls unlink() without verifying the resulting path stays within the intended directory. Authenticated attackers with Subscriber-level permissions can exploit this to delete arbitrary files, including wp-config.php. A fix was introduced in subsequent versions by adding validate_file() checks and improving field validation.

Affected products

  • stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP up to, and including, 1.2.65

Timeline

  • 2026-06-29: patched: Fix committed to GitHub repository.
  • 2026-07-09: advisory: CVE published by Wordfence/NVD.

References