CVE-2026-4979 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter

🗓️ 11 Apr 2026 01:25:00Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Authenticated users can trigger a server side forgery in UsersWP up to version 1.2.58 via the uwp_crop parameter, causing outbound requests.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-4979	11 Apr 202601:25	–	attackerkb
Circl	CVE-2026-4979	11 Apr 202602:26	–	circl
CNNVD	WordPress plugin UsersWP – Front-end login form, User Registration, User Profile & Members Directory 代码问题漏洞	11 Apr 202600:00	–	cnnvd
CVE	CVE-2026-4979	11 Apr 202601:25	–	cve
Cvelist	CVE-2026-4979 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter	11 Apr 202601:25	–	cvelist
EUVD	EUVD-2026-21649	11 Apr 202601:25	–	euvd
NVD	CVE-2026-4979	11 Apr 202602:16	–	nvd
Patchstack	WordPress UsersWP plugin <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter vulnerability	12 Apr 202623:31	–	patchstack
Positive Technologies	PT-2026-32088	11 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4979	13 Apr 202619:24	–	redhatcve

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/class-forms.php
plugins	www.plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/helpers/misc.php
plugins	www.plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php
plugins	www.plugins.trac.wordpress.org/browser/userswp/trunk/includes/helpers/misc.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9cd2b3fd-1bca-4611-9753-ccb57b0e36a4
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4979.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4979
github	www.github.com/AyeCode/userswp/commit/ca0c81b9c76a26c5ac78a8f3604cf9122a7a4aa1

15 Jul 2026 01:49Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15

EPSS0.00356