The UsersWP plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in the upload_file_remove() AJAX handler. The parameter controlling which usermeta field to clear ($htmlvar) is not validated against an allowed whitelist nor checked for admin-only restrictions. This allows authenticated users with subscriber-level privileges or above to clear or reset restricted usermeta fields on their own user records, circumventing intended access controls. The vulnerability affects all versions up to and including 1.2.58. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation is currently documented.

An authenticated attacker with subscriber-level access or higher can bypass field-level access restrictions to clear or reset restricted usermeta fields on their own user profile. This could lead to unauthorized modification of user metadata fields intended for administrative use only, potentially affecting the integrity of user data. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting subscriber-level access or monitoring for suspicious activity related to usermeta modifications. Avoid granting unnecessary privileges to users. Do not rely on the plugin's field-level access controls for sensitive metadata until patched.