stiofansisland UsersWP Plugin up to 1.2.58 on WordPress AJAX upload_file_remove htmlvar authorization

Summaryinfo

A vulnerability, which was classified as critical, was found in stiofansisland UsersWP Plugin up to 1.2.58 on WordPress. Affected by this vulnerability is the function upload_file_remove of the component AJAX Handler. Such manipulation of the argument htmlvar leads to authorization. This vulnerability is listed as CVE-2026-4977. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in stiofansisland UsersWP Plugin up to 1.2.58 on WordPress. Affected by this issue is the function upload_file_remove of the component AJAX Handler. The manipulation of the argument htmlvar with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.

The weakness was presented by Quang Huynh Ngoc. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-4977 since 03/27/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.2.54 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• stiofansisland

Name

• UsersWP Plugin

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30
• 1.2.31
• 1.2.32
• 1.2.33
• 1.2.34
• 1.2.35
• 1.2.36
• 1.2.37
• 1.2.38
• 1.2.39
• 1.2.40
• 1.2.41
• 1.2.42
• 1.2.43
• 1.2.44
• 1.2.45
• 1.2.46
• 1.2.47
• 1.2.48
• 1.2.49
• 1.2.50
• 1.2.51
• 1.2.52
• 1.2.53
• 1.2.54
• 1.2.55
• 1.2.56
• 1.2.57
• 1.2.58

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion