CVE-2026-110963: Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit the exposed AJAX action. No existing WordPress account or administrative access is required.

Q: What level of access can exploitation provide?

An attacker can create a new administrator account or modify arbitrary site options. Either outcome can lead to complete takeover of the WordPress site.

Q: Is a default or publicly accessible installation exposed?

The vulnerable AJAX action is available to unauthenticated users, and its protective nonce is publicly exposed. A publicly reachable site using the affected plugin version is therefore exposed without requiring the attacker to log in.

Published Nov 8, 2026

Updated

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit the exposed AJAX action. No existing WordPress account or administrative access is required.

What level of access can exploitation provide?

An attacker can create a new administrator account or modify arbitrary site options. Either outcome can lead to complete takeover of the WordPress site.

Is a default or publicly accessible installation exposed?

The vulnerable AJAX action is available to unauthenticated users, and its protective nonce is publicly exposed. A publicly reachable site using the affected plugin version is therefore exposed without requiring the attacker to log in.

CVE-2026-110963: Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access can exploitation provide?

Is a default or publicly accessible installation exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access can exploitation provide?

Is a default or publicly accessible installation exposed?