WordPress UsersWP プラグイン <= 1.2.53 - クロスサイトリクエストフォージェリ (CSRF) 脆弱性

The CSRF vulnerability in UsersWP allows an attacker to execute actions on behalf of an authenticated user without their knowledge. This could include modifying user roles, deleting users, or altering plugin settings. The impact is directly tied to the permissions of the user being impersonated. An attacker could gain administrative access if they can trick an administrator into performing a malicious action. The blast radius is limited to the UsersWP plugin's functionality and the WordPress site itself, but successful exploitation could compromise the entire site if administrative actions are affected.

WordPress websites utilizing the UsersWP plugin, particularly those with administrator accounts or sensitive user management configurations, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise on one site could lead to attacks targeting others.

• wordpress / composer / npm:

grep -r 'userswp_ajax_nonce' /var/www/html/wp-content/plugins/userswp/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/userswp/ | grep -i 'referer'

1. 2026-02-03Disclosure

   disclosure

1. 予約済み2026-01-28
2. 公開日2026-02-03
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-25015 is to immediately upgrade the UsersWP plugin to version 1.2.54 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites. While not a direct fix, enabling WordPress's core CSRF protection can offer a layer of defense. After upgrading, verify the plugin's functionality and user roles to ensure no unauthorized changes have occurred.

アクティブインストール数

20K既知

プラグイン評価

4.7

WordPressが必要

6.1+

動作確認済みバージョン

7.0