WordPress Plugin Vulnerabilities

UsersWP < 1.2.48 - Missing Authorization

Description

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.47. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
userswp
Fixed in 1.2.48

References

CVE
CVE-2025-66072
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2e933356-1faf-4766-9554-aad618052d83

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
51781bcf-5134-4a19-b737-71040589e574

Timeline

Publicly Published
2025-11-25 (about 6 months ago)
Added
2025-12-01 (about 6 months ago)
Last Updated
2025-12-01 (about 6 months ago)

Other

Published
Title
Published
2024-12-11
Title
Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation
Published
2026-03-31
Title
Royal Elementor Addons < 1.7.1057 - Unauthenticated Missing Authorization
Published
2024-08-12
Title
Smart Online Order for Clover < 1.5.7 - Missing Authorization
Published
2024-06-06
Title
Market Exporter < 2.0.20 - Missing Authorization to Arbitrary File Deletion
Published
2025-11-04
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending