CVE-2026-13492

Name of the Vulnerable Software and Affected Versions UsersWP versions prior to 1.2.66

Description Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server, including the wp-config.php file. This occurs because the validate fields() function in UsersWP Validation fails to properly validate file-field values, allowing directory-traversal sequences to remain. Subsequently, the upload file remove() AJAX handler constructs the deletion target by concatenating the uploads base directory with attacker-controlled metadata without performing realpath canonicalization or boundary checks before calling the unlink() function. Directory traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update UsersWP to a version beyond 1.2.65.