# CVE-2026-19991: UsersWP Arbitrary File Deletion via AJAX handler

Source: https://junglewise.ai/threats/cve-2026-19991-userswp-arbitrary-file-deletion-via-ajax-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19991 · Severity: high · CVSS 8.1 · Published 2026-09-11

UsersWP is a popular WordPress plugin that manages user profiles and account management. The plugin contains a flaw that allows any logged-in user with basic subscriber access to delete arbitrary files from the website's server, including critical WordPress configuration files. An attacker could leverage this to destroy the website's functionality, expose database credentials, or facilitate further compromise.

## Quick answers

**Is CVE-2026-19991 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19991 being exploited in the wild.

**How severe is CVE-2026-19991?** High severity, with a CVSS score of 8.1, published 11 September 2026.

**Which products and versions are affected?** UsersWP UsersWP up to and including 1.2.70.

**Is there a fix for CVE-2026-19991?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19991 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19991?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the upload_file_remove() AJAX handler. The plugin accepts user-supplied file paths from POST data and validates them using validate_file(), which only checks for literal '../' strings. However, the stored value is later processed through uwp_get_file_relative_url(), which performs a global string replacement that can inadvertently create traversal sequences. A crafted URL containing embedded tokens (e.g., embedded upload base URL patterns) can collapse into '../../' sequences after the final validation, allowing the attacker to reference files outside the intended uploads directory. The resulting path is passed directly to wp_delete_file() without canonical containment checks. This attack requires only subscriber-level authentication and above.

## Affected products

- UsersWP UsersWP up to and including 1.2.70

## Timeline

- 2026-09-11: disclosed
- 2026-09-11: advisory: CVE-2026-19991

## References

- [https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php](https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php)
- [https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php](https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.70/includes/class-forms.php)