CVE-2026-119980
Received Received - Intake

Predictable Password in UsersWP WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-119980
EUVD
EUVD-2026-114605

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the UsersWP WordPress plugin allows unauthenticated attackers to gain unauthorized access to dummy user accounts. The plugin generates a predictable password for 25 built-in dummy accounts using a hash derived from site settings. This password can be extracted from a single HTTP request to the registration page or an AJAX handler, even without authentication. Attackers can then log in as any dummy user, potentially escalating privileges if those accounts have elevated roles.

Detection Guidance

Check WordPress sites using UsersWP plugin versions up to 1.2.78. Inspect network traffic for requests to /register/ or wp_ajax_nopriv_uwp_ajax_register_form. Look for exposed uwp_register_hash values in responses. Verify if dummy user accounts (antawn, chynna, kiki) exist with predictable passwords derived from site_url() and AUTH_KEY.

Impact Analysis

If you use the UsersWP plugin up to version 1.2.78, attackers could exploit this to access your WordPress site as a dummy user. This may lead to unauthorized actions, data theft, or further compromise if dummy accounts have admin privileges. The attack requires no authentication and can be executed via public pages or AJAX requests.

Mitigation Strategies

Update UsersWP plugin to the latest version beyond 1.2.78. Disable dummy user account creation in the plugin's Tools page. Remove existing dummy accounts if present. Rotate AUTH_KEY and site_url() salts in wp-config.php to invalidate derived passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart