UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.77 - Unauthenticated Open Redirect via 'redirect_to' Parameter
- ID
- WPSEC-2026-1918
- Plugin
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (userswp)
- Affected
- from 1.2.73 before 1.2.78
- Remediation
- Update to 1.2.78 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP on WPSec AttackSurface
- Fix released
- Published
Description
The UsersWP plugin for WordPress is vulnerable to Open Redirect via the 'redirect_to' parameter of the AJAX login handler in versions 1.2.73 up to, and including, 1.2.77. The redirect URL returned in the AJAX login response is not checked against allowed hosts, unlike the non-AJAX login flow, which uses wp_safe_redirect(). The front-end script then navigates to that URL. This makes it possible for unauthenticated attackers to send users to external, potentially malicious sites after they log in, if they can trick a user into opening a crafted login page link. The site must use Wordfence Login Security, which makes in-page login forms submit over AJAX, and must have the non-default 'Enable Login Lightbox Redirect' option turned on.
References
- https://wpsec.com/vuln/WPSEC-2026-1918/
- https://plugins.svn.wordpress.org/userswp/tags/1.2.78/
- https://wordpress.org/plugins/userswp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS