Unauthenticated Profile Update Vulnerability in Uix UserCenter Plugin for WordPress
CVE-2026-16259
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 August 2026
Badges
What is CVE-2026-16259?
The Uix UserCenter plugin for WordPress fails to verify that the account being modified through an unauthenticated profile-update action is associated with the requester. This vulnerability arises from a hardcoded signing key used for token authentication that remains the same across all installations. As a result, an attacker can forge a token, allowing them to modify profile details, including an administrator's email and password, which can lead to full account takeover. Proper verification mechanisms should be implemented to enhance security and prevent unauthorized access.
Affected Version(s)
Uix UserCenter 0 <= 1.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.