CVE-2026-110963
Received Received - Intake

Unauthenticated Admin Creation in Userplace WordPress Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: WPScan

Description
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-110963
EUVD
EUVD-2026-119478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Userplace From 0 (inc) to 1.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Userplace WordPress plugin (version 1.2.0 or below) allows unauthenticated attackers to perform actions typically restricted to administrators. The plugin fails to check authorization for an AJAX action and exposes the nonce protecting it, enabling attackers to create admin accounts or modify site settings without logging in.

Detection Guidance

Check if the Userplace WordPress plugin version 1.2.0 or below is installed. Look for unauthorized administrator accounts or modified site options. Review server logs for suspicious AJAX requests to the vulnerable endpoint.

Impact Analysis

Attackers can exploit this to take full control of your WordPress site by creating an administrator account or changing site options. This could lead to defacement, data theft, malware distribution, or complete site compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update the Userplace plugin to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Remove any unauthorized administrator accounts and reset site options to default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...