The UsersWP plugin for WordPress (up to version 1.2.58) contains a blind SSRF vulnerability due to inadequate URL origin validation in the process_image_crop() method. The vulnerability occurs because the uwp_crop POST parameter accepts user-controlled URLs that are only sanitized with esc_url() and checked for file type, but not restricted to local upload paths. These URLs are then used in PHP image processing functions that support URL wrappers, allowing outbound HTTP requests from the server. Authenticated attackers with subscriber-level privileges can exploit this to make arbitrary HTTP requests to attacker-controlled or internal network destinations, potentially enabling internal network reconnaissance and access to sensitive services.

An attacker with subscriber-level or higher access can exploit this vulnerability to coerce the WordPress server into making arbitrary HTTP requests. This can lead to internal network scanning and potentially accessing sensitive internal services that are not otherwise exposed externally. The vulnerability does not directly impact confidentiality or availability but can facilitate further attacks by revealing internal network information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to image cropping features. Avoid exposing sensitive internal services that could be targeted via SSRF.