CVE-2026-4977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4977", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-27T10:19:39.046Z", "datePublished": "2026-04-10T01:25:00.523Z", "dateUpdated": "2026-04-10T13:45:35.270Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-10T01:25:00.523Z"}, "affected": [{"vendor": "stiofansisland", "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.58", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as \"For admin use only\", bypassing intended field-level access restrictions."}], "title": "UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2274"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2274"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2251"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2251"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-meta.php#L165"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-meta.php#L165"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Quang Huynh Ngoc"}], "timeline": [{"time": "2026-03-27T10:34:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-09T12:42:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T13:45:28.489235Z", "id": "CVE-2026-4977", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T13:45:35.270Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4977", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T13:45:28.489235Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T13:45:31.746Z"}}], "cna": {"title": "UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Quang Huynh Ngoc"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "stiofansisland", "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.58"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-27T10:34:54.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-09T12:42:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2274"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2274"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2251"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2251"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-meta.php#L165"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-meta.php#L165"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59"}], "descriptions": [{"lang": "en", "value": "The UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as \"For admin use only\", bypassing intended field-level access restrictions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-10T01:25:00.523Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4977", "state": "PUBLISHED", "dateUpdated": "2026-04-10T13:45:35.270Z", "dateReserved": "2026-03-27T10:19:39.046Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-10T01:25:00.523Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "vendor": "stiofansisland", "versions": [{"lessThanOrEqual": "1.2.58", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as \"For admin use only\", bypassing intended field-level access restrictions."}], "id": "CVE-2026-4977", "lastModified": "2026-06-17T10:57:32.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4977", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T13:45:28.489235Z", "version": "2.0.3"}}]}, "published": "2026-04-10T02:16:03.877", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2251"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-forms.php#L2274"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.54/includes/class-meta.php#L165"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2251"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L2274"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-meta.php#L165"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fuserswp/tags/1.2.58&new_path=%2Fuserswp/tags/1.2.59"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.58]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "source": "cna", "vendor": "stiofansisland"}, "product": "userswp_\u2013_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp", "vendor": "stiofansisland"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-10T02:20:54.101427+00:00", "value": {"mitigation_remediation": ["Upgrade the UsersWP plugin to the latest release (1.2.59 or newer) which fixes the improper access control flaw.", "If an upgrade cannot be performed immediately, restrict access to the upload_file_remove endpoint so that only administrators can call it, or temporarily disable the endpoint.", "Review and tighten role capabilities so that subscribers cannot modify usermeta values that are marked for admin use.", "Monitor user accounts for unexpected changes to metadata, especially fields labeled as \"For admin use only\"."], "summary": {"action": "Upgrade Plugin", "impact": "Privilege Escalation via Restricted Usermeta Modification"}, "threat_synthesis": {"affected_systems": "WordPress installations that are running the UsersWP plugin in any version up to 1.2.58 are affected. The vulnerability resides in the class\u2011forms.php and class\u2011meta.php files that are shipped with the plugin, and no other vendors or products are reported to be impacted.", "description_and_impact": "The UsersWP plugin\u2019s upload_file_remove AJAX handler does not validate the htmlvar parameter against an allowed list or the field\u2019s for_admin_use flag. This flaw lets any authenticated user with subscriber-level access clear or reset arbitrary restricted usermeta values on their own profile, including data that is normally reserved for admins. Because these fields can influence role, capability, or sensitive personal information, an attacker can undermine account integrity or expose confidential data.", "risk_and_exploitability": "The CVSS score is 4.3, indicating moderate severity. No EPSS rating is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited in the wild. The flaw requires authentication; an attacker can trigger it by crafting an AJAX request that supplies the htmlvar key for a restricted field. Although there is no known public exploit code, the ability to overwrite admin\u2011only metadata makes the risk significant enough to warrant immediate remediation."}}}}, "created": "2026-04-10T08:36:07.261695+00:00", "updated": "2026-04-10T09:27:07.353143+00:00", "vendors": ["stiofansisland", "stiofansisland$PRODUCT$userswp_\u2013_front-end_login_form,_user_registration,_user_profile_&_members_directory_plugin_for_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}