CVE-2026-4977
Improper Access Control in UsersWP Plugin Allows Usermeta Manipulation
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| userswp | userswp | to 1.2.58 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the UsersWP WordPress plugin, specifically in the upload_file_remove() AJAX handler. It occurs because the plugin does not properly validate the $htmlvar parameter against a whitelist of allowed fields or check if the field is marked for admin use only.
As a result, authenticated users with subscriber-level access or higher can bypass intended field-level access restrictions and clear or reset any restricted usermeta column for their own user record, including those fields meant only for administrators.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with low-level access (subscriber-level and above) to modify restricted user metadata fields for their own accounts that should normally be protected.
The impact is limited to integrity issues where users can reset or clear sensitive fields that are intended only for admin use, potentially leading to unauthorized changes in user profile data.
The CVSS score of 4.3 indicates a low to medium severity impact, with no confidentiality or availability impact, but with some integrity impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with subscriber-level access and above to bypass intended field-level access restrictions and clear or reset restricted usermeta fields, including those marked "For admin use only".
This improper access control could potentially lead to unauthorized modification of user data, which may impact compliance with data protection standards and regulations such as GDPR and HIPAA that require strict access controls and protection of sensitive user information.