Userplace WordPress plugin: Unauthenticated administrative account creation (CVE-2026-110963)

The Userplace WordPress plugin through 1.2.0 contains an authorization bypass vulnerability. An AJAX action, intended to be restricted, is accessible to unauthenticated users. The plugin also publicly exposes the nonce meant to protect this action. An attacker can use these flaws to inject administrative credentials or alter critical site configuration options, resulting in a full site takeover.

Impact

Successful exploitation allows unauthenticated attackers to perform administrative actions, including the creation of new administrator accounts and the modification of arbitrary WordPress site options.

Recommendation

• Audit WordPress installations for the presence of the Userplace plugin version 1.2.0 or earlier.
• Disable or remove the Userplace plugin until a vendor-supplied patch is installed.
• Review the WordPress 'wp_users' and 'wp_options' tables for unauthorized administrative accounts or suspicious configuration changes created after November 8, 2026.