CVE-2026-16259: Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

Q: Who is exposed to this issue?

WordPress sites using Uix UserCenter version 1.0.3 or earlier are exposed. An attacker does not need an existing account because the vulnerable profile-update action is unauthenticated.

Q: What does an attacker need to exploit it?

The attacker needs to forge a token for a target user. This is possible because the token signing key is hardcoded and the same across every installation.

Q: What is the likely impact of successful exploitation?

An attacker can change an administrator account's email address and password, then take over that account. This can give the attacker administrator-level access to the affected WordPress site.

Published Aug 29, 2026

Updated

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

Affected Software

1 affected component

WordPress plugin<=1.0.3

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Uix UserCenter version 1.0.3 or earlier are exposed. An attacker does not need an existing account because the vulnerable profile-update action is unauthenticated.

What does an attacker need to exploit it?

The attacker needs to forge a token for a target user. This is possible because the token signing key is hardcoded and the same across every installation.

What is the likely impact of successful exploitation?

An attacker can change an administrator account's email address and password, then take over that account. This can give the attacker administrator-level access to the affected WordPress site.

CVE-2026-16259: Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?