CVE-2026-19991
Received Received - Intake

Arbitrary File Deletion in UsersWP WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-19991
EUVD
EUVD-2026-75939

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
userswp userswp to 1.2.70 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The UsersWP WordPress plugin up to version 1.2.70 has an Arbitrary File Deletion vulnerability. It allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server, including critical files like wp-config.php. The flaw occurs due to improper validation of file paths during upload and deletion processes.

Detection Guidance

Check for unauthorized file deletions in WordPress uploads directories. Review server logs for suspicious AJAX requests to UsersWP plugin endpoints, particularly those containing file deletion parameters. Look for patterns like 'upload_file_remove' in access logs.

Impact Analysis

This vulnerability can lead to complete site compromise, data loss, or unauthorized access. Attackers could delete essential files, disrupt services, or gain control of the WordPress installation. It may also allow further exploitation of the server if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized file deletion. GDPR requires data integrity and security, while HIPAA mandates protection of sensitive health information. Unauthorized file deletion may violate these requirements by compromising data availability and integrity.

Mitigation Strategies

Immediately update the UsersWP plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict Subscriber-level user permissions to minimum required access. Monitor file system integrity for unexpected changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart