CVE-2026-12102: UsersWP IDOR Vulnerability Allows Profile Image Deletion

Technical summary

The UsersWP plugin versions up to 1.2.63 contain an Insecure Direct Object Reference (IDOR) vulnerability in the user_id parameter. The vulnerability stems from insufficient access controls on operations that modify the uwp_usermeta table, specifically the avatar_thumb and banner_thumb metadata keys. An authenticated user with editor role or higher can manipulate the user_id parameter to target arbitrary users and clear their profile image metadata without authorization. The CVSS 3.1 score of 2.7 reflects the low severity due to the requirement for authenticated access with editor-level privileges, no confidentiality impact, and limited integrity impact (image metadata deletion only).

Business impact

The primary business impact is limited but notable for user experience. Administrators could have their profile images removed by malicious editors, which may create confusion or require re-upload of images. If the plugin is used in environments where profile image consistency matters for branding or community trust (such as online forums or membership sites), repeated deletion could disrupt operations. However, since this is image metadata deletion rather than data exfiltration or system compromise, the financial or regulatory impact is typically minimal. Organizations should weigh the organizational friction against the likelihood of a malicious editor in their WordPress environment.

Affected systems

Any WordPress installation using the UsersWP plugin in versions 1.2.63 and earlier is affected. The vulnerability is not limited to a specific hosting platform or WordPress configuration—it affects any deployment of the affected plugin version. Organizations should audit their WordPress plugin inventory to identify instances of UsersWP and note the installed version number.

Exploitability

Exploitation requires an authenticated WordPress user account with editor-level access or higher. An attacker cannot exploit this vulnerability as an unauthenticated visitor or as a user with contributor or lower roles. The attack is straightforward once access is obtained: modify the user_id parameter in a request targeting user profile image metadata. No special tools, social engineering, or complex techniques are required. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread weaponized exploitation has been publicly disclosed to date.

Remediation

Update the UsersWP plugin to a patched version above 1.2.63 as soon as the vendor releases one. Verify the patch details in the official plugin repository or vendor advisory before deployment. As an interim control, audit WordPress user accounts with editor or administrator roles and remove or downgrade any accounts that should not have such privileges. Implement additional access controls at the application or infrastructure level to restrict editor role assignments to trusted personnel only.

Patch guidance

Monitor the UsersWP plugin repository and the vendor's official channels for a security update that addresses this IDOR vulnerability. Apply the patch promptly to all affected WordPress installations. Test the patch in a staging environment before production deployment to ensure compatibility with custom code or other plugins. Verify in the patch notes or security advisory that the user_id parameter is now properly validated before any metadata modification operations are permitted.

Detection guidance

Review WordPress audit logs for modifications to user metadata, particularly avatar_thumb and banner_thumb fields in the uwp_usermeta table. Look for patterns where an editor-level user is modifying metadata for users other than themselves, especially if the target users are administrators or high-privilege accounts. Database query logging or WordPress security plugins with detailed action tracking can help identify suspicious metadata operations. Additionally, monitor for any user complaints about missing or deleted profile images where the user did not perform the deletion themselves.

Why prioritize this

Although the CVSS score is low (2.7), this vulnerability should not be dismissed. It requires elevated privileges but targets high-value accounts (administrators). The lack of KEV listing indicates no active widespread exploitation, which reduces urgency slightly. However, if your organization has untrusted editors or a history of insider threats, prioritize patching. For most organizations, this ranks below critical and high-severity vulnerabilities but should be addressed within normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 2.7 (LOW) is driven by several factors: (1) Authentication Requirement: The vulnerability requires a valid WordPress account with editor privileges, eliminating risk from external attackers. (2) Limited Scope: The impact is confined to image metadata deletion with no system-wide effects. (3) No Confidentiality Loss: The attack does not expose sensitive data. (4) Minimal Integrity Impact: Only profile images are affected, not critical user data or site content. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N correctly reflects a network-accessible but privileged, low-impact vulnerability.

Frequently asked questions