CVE-2026-12102
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk20th percentile — higher than 20% of all known CVEs
Summary
The UsersWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.2.63. Authenticated attackers with editor-level access can reset or permanently delete the avatar or banner image of any arbitrary user.
Risk Assessment
This vulnerability may lead to loss of user data and privacy breaches, impacting the organization's reputation. Administrators could become targets of attacks, increasing risk for the entire system.
Recommendation
It is recommended to update the UsersWP plugin to the latest version to mitigate this vulnerability. Additionally, implementing further access controls for managing user data is advisable.
Original NVD description (English source)
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.