CVE-2026-12102 Missing authorization in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Authenticated editors can arbitrarily reset or delete avatars and banners of any user, including administrators, due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12102?
CVE-2026-12102 is a low-severity missing authorization vulnerability in stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP, published on 18 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.
Weakness: CWE-639
Which versions are affected by CVE-2026-12102?
How do I fix CVE-2026-12102?
No fix has been published for CVE-2026-12102 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-12102 being exploited?
There is no known exploitation of CVE-2026-12102 in the wild and no public exploit code.
Sources
Also known as GHSA-crv8-pwhc-5w5p.