What the vulnerability does
01Description
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove() AJAX handler building the deletion target from the uploads basedir concatenated with the attacker-controlled metadata value without any realpath canonicalization or uploads-directory boundary check before calling unlink(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server, including wp-config.
Explanation of Vulnerability in Simple Terms
02Summary
UsersWP versions up to 1.2.65 contain a path traversal vulnerability that allows authenticated users to read, modify, or delete arbitrary files on the server. An attacker with a low-privilege account can bypass file access restrictions and access sensitive data outside the intended directory structure. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete arbitrary files on the server outside the intended application directories.
Potential impact on your site
04Site Impact
Any registered user can access sensitive files, potentially exposing database credentials, configuration, or other users' data.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the WordPress site.
Key dates
06Disclosure timeline
July 9, 2026
CVE published
July 9, 2026
Record updated
