Unauthorized Account Access in UsersWP Plugin for WordPress
CVE-2026-119980
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 October 2026
What is CVE-2026-119980?
The UsersWP plugin for WordPress contains a vulnerability that allows unauthorized account access due to predictable password mechanisms. Specifically, the plugin's method for generating shared passwords for dummy user accounts derives the first part of the password from a predictable hash. This vulnerability enables attackers to recover the dummy passwords through unprotected registration forms and AJAX requests, even with user registration disabled. As a result, it allows unauthorized users to authenticate as any of the 25 built-in dummy accounts, potentially leading to privilege escalation if these accounts possess elevated roles.
Affected Version(s)
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 0 <= 1.2.78