The UsersWP plugin for WordPress contains a time‑based SQL injection flaw in the upload_file_remove function and its htmlvar parameter. Unsanitized input is directly concatenated into an SQL query, enabling an attacker to append arbitrary statements and retrieve sensitive database contents. This weakness, classified as CWE‑89, provides the potential for broad confidential data disclosure and, if combined with other vulnerabilities, could form a stepping stone to further compromise.

All installations of the UsersWP – Front‑end login form, User Registration, User Profile & Members Directory plugin for WordPress up to and including version 1.2.44 are vulnerable. The affected product is maintained by stiofansisland and is widely used as a front‑end user management solution.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is less than 1%, suggesting low exploitation likelihood at the moment. It is not listed in the CISA KEV catalog, reducing its prominence among known exploited flaws. Because the attack vector relies on a public‑facing web form, an unauthenticated attacker can simply submit crafted requests to trigger the injection. The absence of robust input validation and query preparation makes exploitation straightforward for those familiar with SQL injection techniques.