CVE-2026-19991

UsersWP, a WordPress user-profile and registration plugin, is vulnerable to arbitrary file deletion in all versions up to and including 1.2.70 via its upload_file_remove() AJAX handler. Because the account 'file' field value is taken directly from $_POST when no real upload occurs, and the only validation (validate_file()) merely rejects a literal '../', an attacker can store a crafted URL containing embedded '.. ' tokens that collapse into '../../' traversal sequences when uwp_get_file_relative_url() later performs a str_replace() of the uploads base URL — after the final validation — with the transformed path appended to the uploads directory and passed to wp_delete_file() with no canonical containment check. Any authenticated attacker with Subscriber-level access or higher can thereby delete arbitrary files on the server, including wp-config.php, which can break or take down the site (CVSS 3.1: 8.1 High, with high integrity and availability impact). All WordPress sites running UsersWP version 1.2.70 or earlier are affected, most directly where the UsersWP account form includes a file field. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of this analysis.

What to do: Update UsersWP to the first patched release after 1.2.70 as soon as it is available (the data does not specify a fixed version number). Until patched, restrict Subscriber registrations or limit which users can submit the UsersWP account file field, and consider WAF rules blocking crafted file URLs containing '.. ' sequences. Check for signs of exploitation such as unexpectedly missing files on the server, especially wp-config.php.