CVE-2026-4977
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
| CWE | CWE-862 |
| Vendor | stiofansisland |
| Product | userswp – front-end login form, user registration, user profile & members directory plugin for wp |
| Published | Apr 10, 2026 |
| Last Updated | Apr 10, 2026 |
Get instant alerts for stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp
Be the first to know when new medium vulnerabilities affecting stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N