Authorization bypass in stiofansisland UsersWP – Front-end login form, User Registration…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stiofansisland | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | up to 1.2.63 | — | No fix listed | CNA |
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Vendorstiofansisland Affected up to 1.2.63 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12102
- 2026-10-03 Alias added: GHSA-crv8-pwhc-5w5p
References
Other 12
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7115756e-69fa-42fe-bde3-a36e34d4bae3?source=cve
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.63/includes/class-forms.php#L371
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.63/includes/class-forms.php#L389
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.63/includes/class-forms.php#L89
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.63/includes/class-userswp.php#L574
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.63/includes/class-profile.php#L1739
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.61/includes/class-forms.php#L371
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.61/includes/class-forms.php#L389
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.61/includes/class-forms.php#L89
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.61/includes/class-userswp.php#L574
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.61/includes/class-profile.php#L1739
- https://github.com/AyeCode/userswp/commit/0e69f967578904cc26fadd0206270d50b7420298
More stiofansisland vulnerabilities
- TI-2026-11418 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field CVSS 3.1HIGH 8.8
- TI-2026-10027 Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2025-09182 SQL injection in stiofansisland UsersWP – Front-end login form, User Registration, User… CVSS 3.1MEDIUM 6.5
- TI-2026-16210 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 3.1HIGH 8.1
- TI-2026-83502 Predictable password in UsersWP lets attackers access dummy accounts CVSS 3.1MEDIUM 6.5
- TI-2026-14436 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated… CVSS 3.1MEDIUM 6.6
Sources
- CVE-2026-12102 · CVE Program
- CVE-2026-12102 · NVD
- FIRST EPSS
- GHSA-crv8-pwhc-5w5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences