# UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.77 - Unauthenticated Open Redirect via 'redirect_to' Parameter

- **ID:** WPSEC-2026-1918
- **Plugin:** UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (`userswp`), https://wordpress.org/plugins/userswp/
- **Affected versions:** from 1.2.73 before 1.2.78
- **Fixed in:** 1.2.78 (Update to 1.2.78 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/userswp
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1918/

## Description

The UsersWP plugin for WordPress is vulnerable to Open Redirect via the 'redirect_to' parameter of the AJAX login handler in versions 1.2.73 up to, and including, 1.2.77. The redirect URL returned in the AJAX login response is not checked against allowed hosts, unlike the non-AJAX login flow, which uses wp_safe_redirect(). The front-end script then navigates to that URL. This makes it possible for unauthenticated attackers to send users to external, potentially malicious sites after they log in, if they can trick a user into opening a crafted login page link. The site must use Wordfence Login Security, which makes in-page login forms submit over AJAX, and must have the non-default 'Enable Login Lightbox Redirect' option turned on.

## References

- https://wpsec.com/vuln/WPSEC-2026-1918/
- https://plugins.svn.wordpress.org/userswp/tags/1.2.78/
- https://wordpress.org/plugins/userswp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1918/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.