CVE-2026-12102 stiofansisland CVE debrief

Who should care

Users of the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress, especially those with editor-level access and above, should be aware of this vulnerability and take necessary actions to protect their sites.

Technical summary

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.

Defensive priority

Low priority, as the vulnerability requires authenticated attackers with editor-level access and above.

Recommended defensive actions

• Update the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin to a version that fixes the vulnerability.
• Restrict access to the plugin's functionality to only trusted users.
• Monitor user account activity and metadata changes.
• Implement additional security measures, such as two-factor authentication and role-based access control.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-06-18T08:16:33.257Z and was last modified on 2026-06-18T15:23:56.087Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected]. There are source references available that provide additional information about the vulnerability, including a commit that fixes the issue and a class-forms.php file in version 1.2.61. However, the exact scope and impact of the vulnerability are not fully known and defenders should verify the affected systems and implement necessary mitigations.

Official resources