CVE-2026-13492: UsersWP Arbitrary File Deletion – Critical WordPress Plugin Vulnerability

Technical summary

CVE-2026-13492 is a path-traversal-enabled arbitrary file deletion vulnerability in UsersWP's AJAX file removal handler. The root cause is a two-stage validation failure: first, the UsersWP_Validation::validate_fields() function does not strip directory-traversal sequences from 'file'-type fields, instead passing them through sanitize_text_field() which preserves path components. Second, the UsersWP_Forms::upload_file_remove() AJAX endpoint concatenates the uploads base directory with the attacker-controlled metadata value and passes it directly to unlink() without realpath canonicalization or boundary verification. This allows authenticated users to construct paths like `../../../../wp-config.php` that reach outside the uploads directory and delete arbitrary files readable by the web server process.

Business impact

Successful exploitation allows an attacker with even guest-level access to destroy critical WordPress installation files (wp-config.php, wp-settings.php), causing immediate and complete site unavailability. Deletion of the wp-config.php file is particularly severe because it contains database credentials and security keys; recovery requires file restoration from backup or direct file-system access. For sites without reliable backups, this becomes a business-continuity incident. Attackers need only basic user credentials, which can be obtained through account enumeration, weak-password brute force, or social engineering, making the threat surface broader than plugin-specific actions.

Affected systems

UsersWP plugin for WordPress versions up to and including 1.2.65 are vulnerable. The plugin is used to enable user registration, profile management, and member directories on WordPress sites. Any WordPress installation running an affected version of UsersWP with at least one user account (even a restricted Subscriber role) is exposed to this attack. The flaw does not require administrator privileges, significantly expanding the attack surface.

Exploitability

Exploitability is high. The attack requires only network access and valid WordPress credentials at the Subscriber level or above—a low barrier to entry. The AJAX endpoint is unauthenticated at the request-envelope level if the user is logged in, and no additional interaction (UI clicks, CSRF tokens, or user confirmation) is needed. An attacker can send a single HTTP POST request to the file-removal handler with a crafted path parameter to delete a target file. No exploit code or special tools are required; standard curl or HTTP requests suffice. The vulnerability affects the default behavior of the plugin's file management feature.

Remediation

Update the UsersWP plugin to a version that properly validates and restricts file paths. Verify the patched version against the official UsersWP repository or vendor advisory. Pending a patch, disable the file upload and removal features in UsersWP settings, or restrict the plugin to administrator-only use if functionality is essential. As an interim compensating control, restrict wp-config.php permissions to prevent unauthorized deletion at the OS level (owner-read-only), and implement file-integrity monitoring on critical WordPress files to detect unauthorized changes or deletions.

Patch guidance

Consult the official UsersWP plugin repository and vendor security advisory for the patched version number that addresses this vulnerability. After updating, test file upload and deletion workflows in a staging environment to confirm functionality is restored and path-traversal payloads no longer execute. If patched versions are not yet available, consider disabling the plugin entirely or moving to an alternative user-management solution until a fix is released.

Detection guidance

Monitor web-server logs for AJAX POST requests to file-removal endpoints containing path-traversal sequences (strings like `../`, `..\`, `%2e%2e`, or URL-encoded variants) in the request parameters. Use file-integrity monitoring tools (Aide, Samhain, or native WordPress security plugins like WordFence) to detect unexpected deletions or modifications to wp-config.php and other core WordPress files. Query WordPress user-access logs for authentication events followed by suspicious file-removal AJAX calls. In WordPress security plugins, enable alerts for deletion of core configuration files. Endpoint Detection and Response (EDR) solutions should log unlink() system calls originating from the web-server process targeting files outside the intended uploads directory.

Why prioritize this

This vulnerability scores 8.8 (HIGH) under CVSS 3.1 due to the combination of low attack complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability. An attacker with a basic user account can render a site completely unavailable by deleting wp-config.php. The attack is trivial to execute and requires no user interaction. Although the vulnerability is not yet listed on the CISA KEV catalog, the ease of exploitation and immediate business impact make it a critical remediation priority. Organizations running UsersWP should patch or mitigate this flaw as an emergency task.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Attack Vector (Network) – the flaw is exploitable over HTTP/HTTPS; Attack Complexity (Low) – no special conditions or race conditions are required; Privileges Required (Low) – only Subscriber-level access is needed; User Interaction (None) – the attacker's actions trigger the vulnerable code directly; Scope (Unchanged) – impact is limited to the affected system; Confidentiality (High) – wp-config.php and other files may contain sensitive data; Integrity (High) – files can be modified or destroyed; Availability (High) – deletion of core files renders the site offline. The score reflects the realistic threat of rapid, authenticated file deletion by low-privilege users.

Frequently asked questions