The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided (processaccount() calls uwpvalidatefields() and arraymerges the result with the empty output of UsersWPFiles::validateuploads()). At storage time the value is only checked with validatefile(), which passes any string that does not contain a literal '../'. When the value is later processed by uploadfileremove(), it is again gated with validatefile() and then normalized through uwpgetfilerelativeurl(); that helper performs a global strreplace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wpdeletefile() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address