UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stiofansisland | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | up to 1.2.58 | — | No fix listed | CNA |
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Vendorstiofansisland Affected up to 1.2.58 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4979
- 2026-10-03 Alias added: GHSA-cfc8-rw2h-jfg7
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd2b3fd-1bca-4611-9753-ccb57b0e36a4?source=cve
- https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/class-forms.php#L198
- https://plugins.trac.wordpress.org/browser/userswp/trunk/includes/helpers/misc.php#L136
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/class-forms.php#L198
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.55/includes/helpers/misc.php#L136
- https://github.com/AyeCode/userswp/commit/ca0c81b9c76a26c5ac78a8f3604cf9122a7a4aa1
More stiofansisland vulnerabilities
- TI-2026-11418 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field CVSS 3.1HIGH 8.8
- TI-2026-10027 Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2025-09182 SQL injection in stiofansisland UsersWP – Front-end login form, User Registration, User… CVSS 3.1MEDIUM 6.5
- TI-2026-16210 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 3.1HIGH 8.1
- TI-2026-83502 Predictable password in UsersWP lets attackers access dummy accounts CVSS 3.1MEDIUM 6.5
- TI-2026-14436 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated… CVSS 3.1MEDIUM 6.6
Sources
- CVE-2026-4979 · CVE Program
- CVE-2026-4979 · NVD
- FIRST EPSS
- GHSA-cfc8-rw2h-jfg7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences