CyberRota Analysis
AI-GeneratedThe UsersWP plugin for WordPress is vulnerable to arbitrary file deletion due to improper validation of user-supplied input in the upload_file_remove() AJAX handler, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server, including critical files like wp-config.php. This vulnerability arises from the plugin's failure to adequately sanitize file paths, enabling attackers to exploit directory traversal techniques. WordPress site administrators using affected versions of the UsersWP plugin should prioritize patching this vulnerability to mitigate potential data loss and server compromise.
Original NVD Description
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.