Executive brief
UsersWP is a WordPress plugin used to manage user registrations, profiles, and login forms. A security flaw allows logged-in users to clear or reset specific data fields on their own profiles that are normally restricted to administrators. This could allow a user to bypass certain administrative restrictions or remove important account metadata.
Technical details
The vulnerability exists in the upload_file_remove() AJAX handler due to insufficient field-level permission validation. The $htmlvar parameter is not validated against a whitelist of allowed fields, nor does the handler check the field's 'for_admin_use' property. An authenticated attacker with at least subscriber-level privileges can exploit this to clear or reset any restricted usermeta column for their own user record, including fields intended for administrative use only. This issue is fixed in version 1.2.59.
Affected products
- UsersWP UsersWP – Front-end login form, User Registration, User Profile & Members Directory Up to and including 1.2.58
Timeline
- 2026-04-10: advisory: NVD published the vulnerability details.
- 2026-04-10: patched: A fix was identified in version 1.2.59 via plugin changeset.
References
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-meta.php
- https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php
- https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php
- https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-meta.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59