{
 "id": "WPSEC-2026-1918",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1918/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1918/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1918/index.md",
 "title": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.77 - Unauthenticated Open Redirect via 'redirect_to' Parameter",
 "description": "The UsersWP plugin for WordPress is vulnerable to Open Redirect via the 'redirect_to' parameter of the AJAX login handler in versions 1.2.73 up to, and including, 1.2.77. The redirect URL returned in the AJAX login response is not checked against allowed hosts, unlike the non-AJAX login flow, which uses wp_safe_redirect(). The front-end script then navigates to that URL. This makes it possible for unauthenticated attackers to send users to external, potentially malicious sites after they log in, if they can trick a user into opening a crafted login page link. The site must use Wordfence Login Security, which makes in-page login forms submit over AJAX, and must have the non-default 'Enable Login Lightbox Redirect' option turned on.",
 "plugin": {
  "slug": "userswp",
  "name": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP",
  "full_name": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP",
  "wordpress_org": "https://wordpress.org/plugins/userswp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/userswp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/userswp"
 },
 "type": "REDIRECT",
 "cwe": [
  "CWE-601"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.73",
    "from_inclusive": true,
    "to": "1.2.78",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.73 before 1.2.78"
  ]
 },
 "introduced_in": "1.2.73",
 "fixed_in": "1.2.78",
 "remediation": "Update to 1.2.78 or later.",
 "fix_released": "2026-10-28T15:11:30+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:42:28.708136+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1918/",
  "https://plugins.svn.wordpress.org/userswp/tags/1.2.78/",
  "https://wordpress.org/plugins/userswp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/userswp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}