UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by arbitrary file deletion. Exploitation requires an authenticated subscriber account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 1.2.70.

UsersWP before 1.2.67 lets an attacker who already knows a protected user's username and password bypass that user's second factor. After the password stage supplies a user-specific uwp-auth-id and wp-auth-nonce, the unauthenticated admin-ajax action uwp_ajax_login_process_2fa reaches Forms::process_login_2fa(). The handler accepts the attacker-controlled provider parameter but, before 1.2.67, validates a second factor only when its value exactly matches totp, email or backup_codes. Any other provider value skips every validation branch, after which the handler deletes the login nonce, calls wp_set_auth_cookie() for the selected user and reports successful authentication. The linked WPScan advisory withholds its request proof of concept until August 8, 2026, but the official 1.2.66/1.2.67 source diff discloses this data path.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by arbitrary file deletion. Exploitation requires an authenticated subscriber account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 1.2.65.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by broken access control. Exploitation requires an authenticated editor account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 1.2.63.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is <= 1.2.58.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.2.58.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.2.60.

UsersWP is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

UsersWP is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

UsersWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

UsersWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

UsersWP is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

UsersWP is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

UsersWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

UsersWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.