Executive brief
UsersWP is a popular WordPress plugin that manages user profiles and account management. The plugin contains a flaw that allows any logged-in user with basic subscriber access to delete arbitrary files from the website's server, including critical WordPress configuration files. An attacker could leverage this to destroy the website's functionality, expose database credentials, or facilitate further compromise.
Technical details
The vulnerability is a path traversal flaw in the upload_file_remove() AJAX handler. The plugin accepts user-supplied file paths from POST data and validates them using validate_file(), which only checks for literal '../' strings. However, the stored value is later processed through uwp_get_file_relative_url(), which performs a global string replacement that can inadvertently create traversal sequences. A crafted URL containing embedded tokens (e.g., embedded upload base URL patterns) can collapse into '../../' sequences after the final validation, allowing the attacker to reference files outside the intended uploads directory. The resulting path is passed directly to wp_delete_file() without canonical containment checks. This attack requires only subscriber-level authentication and above.
Affected products
- UsersWP UsersWP up to and including 1.2.70
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory: CVE-2026-19991