The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress contains a blind SSRF vulnerability due to inadequate URL origin validation in the process_image_crop() method. The vulnerability exists because the uwp_crop POST parameter accepts user-controlled URLs that are only sanitized with esc_url() and checked for file extension via wp_check_filetype(), but not restricted to local uploads. These URLs are then used in PHP image processing functions that support URL wrappers and perform outbound HTTP requests, allowing attackers with subscriber-level privileges or higher to coerce the server into making arbitrary HTTP requests to attacker-controlled or internal network destinations.

An authenticated attacker with subscriber-level access or above can exploit this vulnerability to make the WordPress server send arbitrary HTTP requests. This can be used for internal network reconnaissance and potentially accessing sensitive internal services that are not directly exposed externally. The vulnerability does not directly allow data modification or denial of service but poses a risk of information disclosure and network mapping.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to image cropping features. Avoid exposing sensitive internal services that could be targeted via SSRF.