Security Flaw in Userplace Plugin Allows Unauthorized Access to WordPress Sites
CVE-2026-110963
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110963?
The Userplace plugin for WordPress versions up to 1.2.0 contains a significant security issue where authorization checks are not enforced on specific AJAX actions. This flaw allows unauthenticated users to exploit the exposed nonce, enabling them to create an administrator account or manipulate site options. Consequently, the vulnerability presents a pathway for potential attackers to gain full control over WordPress sites, posing a serious threat to website integrity and data security.
Affected Version(s)
Userplace 0 <= 1.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.