https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 18:32:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-12102 <p>The UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the &#39;user_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.</p> <p>The UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the &#39;user_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.</p> https://db.gcve.eu/vuln/fkie_cve-2026-12102 https://db.gcve.eu/vuln/ghsa-crv8-pwhc-5w5p <p>The UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the &#39;user_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.</p> <p>The UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the &#39;user_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.</p> https://db.gcve.eu/vuln/ghsa-crv8-pwhc-5w5p