{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3auserplaceuserplacewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:userplace:userplace:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110963"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Userplace (\u003c= 1.2.0)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","wordpress","cve-2026-110963","authorization-bypass"],"_cs_type":"advisory","_cs_vendors":["Userplace"],"content_html":"\u003cp\u003eThe Userplace WordPress plugin through 1.2.0 contains an authorization bypass vulnerability. An AJAX action, intended to be restricted, is accessible to unauthenticated users. The plugin also publicly exposes the nonce meant to protect this action. An attacker can use these flaws to inject administrative credentials or alter critical site configuration options, resulting in a full site takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform administrative actions, including the creation of new administrator accounts and the modification of arbitrary WordPress site options.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress installations for the presence of the Userplace plugin version 1.2.0 or earlier.\u003c/li\u003e\n\u003cli\u003eDisable or remove the Userplace plugin until a vendor-supplied patch is installed.\u003c/li\u003e\n\u003cli\u003eReview the WordPress 'wp_users' and 'wp_options' tables for unauthorized administrative accounts or suspicious configuration changes created after November 8, 2026.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T21:28:26Z","date_published":"2026-11-08T21:28:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-userplace-plugin-takeover/","summary":"The Userplace WordPress plugin through 1.2.0 fails to perform authorization checks on an exposed AJAX action, allowing unauthenticated attackers to create administrator accounts and modify site settings for full site takeover.","title":"Userplace WordPress plugin: Unauthenticated administrative account creation (CVE-2026-110963)","url":"https://feed.craftedsignal.io/briefs/2026-11-userplace-plugin-takeover/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:userplace:userplace:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}