CVE-2026-86814
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
Risk Assessment
An attacker can take over an administrator account, gaining full control over the site, including access to user data and the ability to modify content.
Recommendation
Update the plugin to version 1.5.10 or later. Enforce email verification by social login providers and monitor login logs for suspicious activity.
Other vulnerabilities in UsersWP
See all- CVE-2026-19991High
The UsersWP plugin for WordPress (versions up to and including 1.2.70) is vulnerable to Arbitrary File Deletion via the upload_file_remove() AJAX handler. An authenticated attacker with Subscriber-level access or above can delete arbitrary files on the server, including wp-config.
- CVE-2026-18501Medium
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-13492High
The UsersWP plugin for WordPress up to version 1.2.65 is vulnerable to arbitrary file deletion. This is due to insufficient validation of file fields in the UsersWP_Validation::validate_fields() function and lack of path canonicalization in the UsersWP_Forms::upload_file_remove() AJAX handler, allowing deletion of any file on the server.
Original NVD description (English source)
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS