221 matches found
CVE-2026-103086
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
EUVD-2026-92581
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
CVE-2026-103086
The UsersWP WordPress plugin (versions up to and including 1.2.74 ) contains a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to an integrity impact as indicated by the CVSS 3.1 vector. No s...
CVE-2026-103086 WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Md. Moniruzzaman Prodhan in WordPress Plugin UsersWP versions = 1.2.74...
WordPress UsersWP plugin < 1.5.10 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin UsersWP Social Login versions 1.5.10...
CVE-2026-86814
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...
CVE-2026-86814
The UsersWP - Social Login WordPress plugin (versions before 1.5.10 ) is vulnerable to an unauthenticated account takeover due to improper privilege management. The root cause is that the plugin fails to verify if a social login provider has confirmed ownership of an email address before using th...
CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...
EUVD-2026-83506
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...
CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...
PT-2026-95759
Name of the Vulnerable Software and Affected Versions UsersWP versions prior to 1.5.10 Description An issue exists where the plugin fails to verify if a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated...
CVE-2026-86814: Improper Privilege Management
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...
CVE-2026-19991
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
CVE-2026-19991
CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...
CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
EUVD-2026-75939
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
PT-2026-89754
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided process accoun...
CVE-2026-19991: Improper Limitation of a Pathname to a Restricted Directory
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...