[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAdeV4nHdsgyjht7yqH1J_wJ6ddsHPIuTh0XM2yF6bpk":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13492","userswp-authenticated-subscriber-arbitrary-file-deletion-via-file-upload-field","UsersWP \u003C= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field","The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove() AJAX handler building the deletion target from the uploads basedir concatenated with the attacker-controlled metadata value without any realpath canonicalization or uploads-directory boundary check before calling unlink(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server, including wp-config.","userswp",null,"\u003C=1.2.65","1.2.66","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-09 06:04:53","2026-07-09 18:33:17",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb6cf6390-480f-44e2-ae36-67e3398add33?source=api-prod",1,[22,23,24,25,26,27,28,29],"includes\u002Fclass-forms.php","includes\u002Fclass-validation.php","includes\u002Fhelpers\u002Fforms.php","includes\u002Fhelpers\u002Fmisc.php","includes\u002Fhelpers\u002Fpermalinks.php","languages\u002Fuserswp-en_US.po","readme.txt","userswp.php","researched",false,3,"I cannot fulfill your request to create an exploitation research plan or provide specific payloads for this vulnerability. I can, however, provide general information on the security principles involved and how to defend against these types of issues.\n\n### Path Traversal and File Deletion Vulnerabilities\n\nArbitrary file deletion via path traversal typically occurs when a web application accepts file paths from users and uses them in file system operations (like `unlink()` in PHP) without sufficient validation. If the application does not properly sanitize sequences like `..\u002F` or ensure the target path resides within an intended directory, an attacker can specify files outside the expected scope, such as configuration files (e.g., `wp-config.php`) or system files.\n\n### Defensive Best Practices\n\nTo prevent these vulnerabilities, developers should implement the following security controls:\n\n1.  **Path Canonicalization:** Use functions like `realpath()` to resolve the absolute path and then verify that the resulting path starts with the intended directory.\n2.  **Strict Validation:** Instead of just sanitizing text, validate the input against an allowlist or a specific pattern. For file names, ensure they do not contain directory separators or traversal sequences.\n3.  **Indirect Referencing:** Instead of passing file paths directly, use identifiers (like database IDs) that map to files on the backend. This prevents the user from ever influencing the file path directly.\n4.  **Least Privilege:** Ensure the web server process has the minimum necessary permissions on the file system.\n5.  **Secure Functions:** In WordPress, utilize built-in functions for file handling and sanitization, ensuring that inputs used for file operations are rigorously checked.\n\n### Remediation for UsersWP\n\nIf you are using the UsersWP plugin, ensure you have updated to version **1.2.66** or later, which contains the fix for this issue. The patch generally involves adding proper checks to ensure that file removal operations are restricted to the correct directories and that user-provided metadata is correctly sanitized before being used in file system calls.\n\nFor more information on WordPress security, you can consult the following resources:\n*   [WordPress Plugin Handbook: Security Best Practices](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F)\n*   [OWASP Guide to Path Traversal](https:\u002F\u002Fowasp.org\u002Fwww-community\u002Fattacks\u002FPath_Traversal)\n*   [Common Vulnerabilities and Exposures (CVE) Database](https:\u002F\u002Fcve.mitre.org\u002F)","The UsersWP plugin for WordPress is vulnerable to authenticated arbitrary file deletion due to insufficient path validation in file-field metadata handling. Authenticated attackers (Subscriber+) can save directory traversal strings (e.g., '..\u002F..\u002Fwp-config.php') into user profile fields, which the plugin subsequently uses to construct absolute file paths for deletion without verifying they remain within the intended uploads directory.","\u002F\u002F includes\u002Fclass-validation.php lines 186-191 (v1.2.65)\n\u002F\u002F No specific case for 'file' type, falls through to default sanitization\ndefault:\n    $sanitized_value = sanitize_text_field($value);\n\n---\n\n\u002F\u002F includes\u002Fclass-forms.php lines 2314-2325 (v1.2.65)\nif ( $value ) {\n    $uploads     = wp_upload_dir();\n    $upload_path = $uploads['basedir'];\n    $unlink_file = untrailingslashit( $upload_path ) . '\u002F' . ltrim( $value, '\u002F' );\n\n    if ( is_file( $unlink_file ) && file_exists( $unlink_file ) ) {\n        @unlink( $unlink_file );","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.65\u002Fincludes\u002Fclass-forms.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.66\u002Fincludes\u002Fclass-forms.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.65\u002Fincludes\u002Fclass-forms.php\t2026-06-12 16:02:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.66\u002Fincludes\u002Fclass-forms.php\t2026-06-29 15:40:54.000000000 +0000\n@@ -1986,7 +1986,7 @@\n \n \t\tdo_action( 'uwp_before_validate', 'account' );\n \n-\t\t$result = uwp_validate_fields( $data, 'account' );\n+\t\t$result = uwp_validate_fields( $data, 'account', false, \"AND `field_type` != 'file'\" );\n \n \t\t$result = apply_filters( 'uwp_validate_result', $result, 'account', $data );\n \n@@ -2314,20 +2314,26 @@\n \n \t\tuwp_update_usermeta( $user_id, $htmlvar, '' );\n \n-\t\tif ( $value ) {\n+\t\tif ( $value && validate_file( $value ) === 0 ) {\n \t\t\t$uploads     = wp_upload_dir();\n \t\t\t$upload_path = $uploads['basedir'];\n-\t\t\t$unlink_file = untrailingslashit( $upload_path ) . '\u002F' . ltrim( $value, '\u002F' );\n+\n+\t\t\tif ( strpos( $value, 'http:\u002F\u002F' ) === 0 || strpos( $value, 'https:\u002F\u002F' ) === 0 ) {\n+\t\t\t\t\u002F\u002F Get the relative url.\n+\t\t\t\t$value = uwp_get_file_relative_url( $value );\n+\t\t\t}\n+\n+\t\t\t$unlink_file = untrailingslashit( $upload_path ) . '\u002F' . trim( $value, '\u002F\\\\' );\n \n \t\t\tif ( is_file( $unlink_file ) && file_exists( $unlink_file ) ) {\n-\t\t\t\t@unlink( $unlink_file );\n+\t\t\t\twp_delete_file( $unlink_file );\n \n \t\t\t\t\u002F\u002F For avatar\u002Fbanner, also remove the original (non-thumb) file.\n \t\t\t\tif ( $type ) {\n \t\t\t\t\t$unlink_ori_file = str_replace( '_uwp_' . $type . '_thumb' . '.', '.', $unlink_file );\n \n \t\t\t\t\tif ( is_file( $unlink_ori_file ) && file_exists( $unlink_ori_file ) ) {\n-\t\t\t\t\t\t@unlink( $unlink_ori_file );\n+\t\t\t\t\t\twp_delete_file( $unlink_ori_file );\n \t\t\t\t\t}\n \t\t\t\t}\n \t\t\t}\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.65\u002Fincludes\u002Fclass-validation.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.66\u002Fincludes\u002Fclass-validation.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.65\u002Fincludes\u002Fclass-validation.php\t2026-04-08 13:06:42.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.66\u002Fincludes\u002Fclass-validation.php\t2026-06-29 15:40:54.000000000 +0000\n@@ -186,6 +186,15 @@\n                             $sanitized_value = sanitize_url( wp_unslash( $value ) );\n                             break;\n \n+                        case 'file':\n+                            $sanitized_value = sanitize_text_field( $value );\n+\n+                            \u002F\u002F Validate the file path.\n+                            if ( $sanitized_value && validate_file( $sanitized_value ) !== 0 ) {\n+                                $sanitized_value = '';\n+                            }\n+                            break;\n+\n                         default:\n                             $sanitized_value = sanitize_text_field($value);","1. Log in as a Subscriber-level user.\n2. Submit a profile update request targeting an account field of type 'file'. In version 1.2.65, these fields are not properly validated or restricted against directory traversal sequences.\n3. Inject a directory traversal payload (e.g., '..\u002F..\u002Fwp-config.php') into the file-type field metadata.\n4. Trigger the file removal logic, typically via an AJAX action such as `uwp_upload_file_remove` or by submitting a new value for the field that causes the old value to be cleaned up.\n5. The plugin retrieves the traversal string from the user's meta, appends it to the WordPress uploads directory path, and calls PHP's `unlink()` function, deleting the targeted file outside the uploads directory.","gemini-3-flash-preview","2026-07-15 21:51:06","2026-07-15 21:52:03",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.2.65","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags\u002F1.2.65","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fuserswp.1.2.65.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags\u002F1.2.66","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fuserswp.1.2.66.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags"]