Blind Server-Side Request Forgery in UsersWP Plugin for WordPress
CVE-2026-4979
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 April 2026
What is CVE-2026-4979?
The UsersWP plugin for WordPress, which facilitates front-end login, user registration, and member directory functionalities, is susceptible to a vulnerability that allows authenticated users to exploit blind server-side request forgery. This issue originates from inadequate validation of URL origins in the process_image_crop() method, affecting all versions up to and including 1.2.58. An attacker can inject a user-controlled URL through the uwp_crop POST parameter, bypassing necessary verification checks for local uploads. As a result, the WordPress server may be coerced into executing arbitrary HTTP requests, potentially leading to internal network scanning and unauthorized access to sensitive services.
Affected Version(s)
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 0 <= 1.2.58