Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-110963: Userplace plugin lets anyone become admin
CVE-2026-110963 · published 1 day ago
Summary
The Userplace plugin for WordPress, up to version 1.2.0, lets anyone on the internet create an administrator account or change site settings because it fails to verify who is making the request. This can give a stranger full control of your website. Update the plugin to a newer version or remove it, and make sure only trusted users can access the site’s administration area.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | userplace | <= 1.2.0 |
Original advisory text
Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
References
- https://wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/ exploit vdb-entry technical-description
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Track software like this
Free during beta