CVE-2026-13690
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
Risk Assessment
An attacker can hijack a user account even if two-factor authentication is enabled, increasing the risk of unauthorized access.
Recommendation
Update the UsersWP plugin to version 1.2.67 or later.
Other vulnerabilities in WordPress plugin
See all- CVE-2026-14300High
The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.
- CVE-2026-14234High
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).
- CVE-2026-13605Medium
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption written into the page DOM without escaping. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator, who clicks the link.
- CVE-2026-11351Medium
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints. This allows unauthenticated users to retrieve information about non-published WooCommerce products (e.g., draft, pending, or private).
Original NVD description (English source)
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.