Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-10 | 2 | Disclosure1General1 |
| 2026-04-11 | 1 | Disclosure1 |
| 2026-04-19 | 1 | PoC1 |
CVE-2026-4977 The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up… https://www.cve.org/CVERecord?id=CVE-2026-4977
Post summary
The text simply notes the CVE identifier and its vulnerability type without offering details on exploit availability, active use in attacks, or remediation.
https://atomicedge.io/cve-proof/cve-2026-4977-userswp-version-1-2-58-medium-vulnerability-proof-of-concept CVE-2026-4977 #WordPress plugin #vulnerability userswp #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post shares a proof‑of‑concept link for CVE‑2026‑4977 affecting UsersWP 1.2.58, noting a medium‑severity vulnerability.
⚡ New CVE Alert: CVE-2026-4977 📊 Severity: 4.3 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4977 #CVE-2026-4977 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/rt0e9xiB5j
Post summary
A brief disclosure of CVE-2026-4977 is posted, noting its 4.3 severity and impact on WordPress, but no additional technical or exploit information is provided.
CVE-2026-4977 Improper Access Control in UsersWP Plugin for WordPress Up to 1.2.58 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4977
Post summary
The text announces CVE-2026-4977, describing an improper access control flaw in the UsersWP WordPress plugin up to version 1.2.58, but provides no PoC, exploit, patch, or active exploitation details.