CVE-2026-19991 is a path traversal vulnerability (CWE-22) in the UsersWP plugin for WordPress versions up to and including 1.2.70. The vulnerability arises because the plugin accepts a 'file' parameter from POST data without proper canonicalization. Although validate_file() blocks literal '../' sequences, a crafted URL containing embedded '..<uploads-baseurl>' tokens can be transformed after validation to include '../../' sequences. This allows an authenticated attacker with Subscriber-level privileges or higher to delete arbitrary files on the server via the upload_file_remove() AJAX handler, including critical files such as wp-config.php. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) with network attack vector, low attack complexity, and privileges required.

An attacker with at least Subscriber-level access can delete arbitrary files on the affected WordPress server, potentially causing denial of service or loss of critical configuration files. This can disrupt website functionality and compromise site integrity.

No official patch or fix is currently referenced in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and consider disabling or restricting the vulnerable plugin's functionality to prevent exploitation.