UsersWP, a WordPress plugin that supplies front‑end login, user registration, and profile features, contains a blind Server‑Side Request Forgery flaw (CWE‑918). The defect is in the process_image_crop() function, which accepts a user‑controlled URL via the uwp_crop POST parameter. The code uses esc_url() and wp_check_filetype() for sanitization but does not enforce a local upload origin, allowing the URL to point to any remote or internal address. That URL is then handed to image functions that support URL wrappers, causing the WordPress server to make arbitrary outbound HTTP requests. An authenticated user with subscriber‑level permissions or higher can thus trigger the server to reach externally controlled sites or internal network targets, enabling internal scanning or access to sensitive services.

All UsersWP releases by stiofansisland up to and including version 1.2.58 are affected. The vulnerability is confined to the image cropping functionality of that plugin and does not impact other WordPress core components or third‑party plugins.

The CVSS score of 5.0 denotes medium severity. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated user with subscriber or higher privileges and the submission of a crafted uwp_crop POST parameter containing an arbitrary URL. The attacker can coerce the WordPress server into making outbound HTTP requests to any destination, which can reveal internal network information or access privileged services. While the vulnerability does not grant direct code execution or privilege escalation, it provides a valuable foothold for further reconnaissance or internal attacks.