UsersWP < 1.2.12 - Users Information Disclosure
Priority HIGH 66Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed UsersWP (Unknown): 1.2.12
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | UsersWP | before 1.2.12 | 1.2.12 | Patch available | CNA |
- UsersWP VendorUnknown Affected before 1.2.12 Fixed in 1.2.12 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ayecode:userswp:*:*:*:*:*:wordpress:*:* | before 1.2.12 | Vulnerable | AyeCode Ltd |
- cpe:2.3:a:ayecode:userswp:*:*:*:*:*:wordpress:*:* Versions before 1.2.12 Vulnerable ·AyeCode Ltd
Remediation
- Fix · CNA UsersWP (Unknown) Fixed in 1.2.12
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6477
- 2026-10-03 Alias added: GHSA-jrj5-pj64-4f42
References
More AyeCode Ltd Userswp vulnerabilities
- TI-2024-05812 SQL injection in stiofansisland UsersWP – Front-end login form, User Registration, User… CVSS 3.1CRITICAL 9.8
- TI-2022-23519 WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection CVSS 3.1HIGH 8.8
- TI-2024-02251 UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
- TI-2022-00365 UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override CVSS 3.1MEDIUM 4.3
Sources
- CVE-2024-6477 · CVE Program
- CVE-2024-6477 · NVD
- FIRST EPSS
- GHSA-jrj5-pj64-4f42 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences