CVE-2026-119980
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The UsersWP plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in versions up to 1.2.78. The vulnerability exists because get_dummy_user_passowrd() derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25), while the full 25-character value of that same hash is simultaneously embedded in the hidden 'uwp_register_hash' field rendered on every registration form response — reachable without authentication via both the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through wp-login.php, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
Risk Assessment
Potential takeover of dummy accounts, and if elevated privileges are involved, privilege escalation and access to administrative functions. The risk applies to sites using the UsersWP plugin where dummy accounts have been created.
Recommendation
Update the UsersWP plugin to a version later than 1.2.78. If updating is not possible, remove all dummy accounts created by the plugin.
Other vulnerabilities in UsersWP
See all- CVE-2026-94641High
The UsersWP plugin for WordPress (up to version 1.2.73) is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that is reflected and executed in the user's browser.
- CVE-2026-103086Medium
The UsersWP plugin for WordPress up to version 1.2.74 contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured access control.
- CVE-2026-86814High
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
- CVE-2026-19991High
The UsersWP plugin for WordPress (versions up to and including 1.2.70) is vulnerable to Arbitrary File Deletion via the upload_file_remove() AJAX handler. An authenticated attacker with Subscriber-level access or above can delete arbitrary files on the server, including wp-config.
- CVE-2026-18501Medium
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-13492High
The UsersWP plugin for WordPress up to version 1.2.65 is vulnerable to arbitrary file deletion. This is due to insufficient validation of file fields in the UsersWP_Validation::validate_fields() function and lack of path canonicalization in the UsersWP_Forms::upload_file_remove() AJAX handler, allowing deletion of any file on the server.
- CVE-2025-67593Medium
The UsersWP plugin (versions up to and including 1.2.48) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
- CVE-2025-66072Medium
The UsersWP (userswp) plugin up to version 1.2.47 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS