Junglewise Threat Intelligence

CVE-2026-4979: AyeCode UsersWP SSRF in process_image_crop

CVE-2026-4979 · Severity: medium · CVSS 5 · Published 2026-04-11

Vendors: AyeCode.

Executive brief

UsersWP, a WordPress plugin used for managing user profiles and registration, contains a security flaw in its image processing features. An attacker with a basic user account can trick the website's server into making unauthorized requests to internal systems or other websites. This could allow an attacker to scan private internal networks or access sensitive services that are not normally exposed to the internet.

Technical details

The UsersWP plugin for WordPress is vulnerable to blind Server-Side Request Forgery (SSRF) in versions up to and including 1.2.58. The vulnerability exists within the process_image_crop() method, which handles avatar and banner image cropping. The function accepts a user-provided URL via the 'uwp_crop' POST parameter but fails to verify that the URL points to a local file. Instead, it only performs basic sanitization and file extension checks before passing the URL to PHP functions like getimagesize() and imagecreatefrom*(). Because these functions support URL wrappers, an authenticated attacker with subscriber-level permissions can force the server to make outbound HTTP requests. This can be used to perform internal network scanning or interact with internal services. A fix has been committed to the plugin's repository.

Affected products

  • AyeCode UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP up to, and including, 1.2.58

Timeline

  • 2026-03-27: patched: Fix committed to GitHub repository
  • 2026-04-11: disclosed: NVD publication date

References