The UsersWP plugin’s upload_file_remove AJAX handler does not validate the htmlvar parameter against an allowed list or the field’s for_admin_use flag. This flaw lets any authenticated user with subscriber-level access clear or reset arbitrary restricted usermeta values on their own profile, including data that is normally reserved for admins. Because these fields can influence role, capability, or sensitive personal information, an attacker can undermine account integrity or expose confidential data.

WordPress installations that are running the UsersWP plugin in any version up to 1.2.58 are affected. The vulnerability resides in the class‑forms.php and class‑meta.php files that are shipped with the plugin, and no other vendors or products are reported to be impacted.

The CVSS score is 4.3, indicating moderate severity. No EPSS rating is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited in the wild. The flaw requires authentication; an attacker can trigger it by crafting an AJAX request that supplies the htmlvar key for a restricted field. Although there is no known public exploit code, the ability to overwrite admin‑only metadata makes the risk significant enough to warrant immediate remediation.