CVE-2026-19991

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided (process account() calls uwp validate fields() and array merges the result with the empty output of UsersWP Files::validate uploads()). At storage time the value is only checked with validate file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload file remove(), it is again gated with validate file() and then normalized through uwp get file relative url(); that helper performs a global str replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp delete file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.