Userplace (<= 1.2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/userplace--1.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 21:28:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUserplace WordPress plugin: Unauthenticated administrative account creation (CVE-2026-110963)https://feed.craftedsignal.io/briefs/2026-11-userplace-plugin-takeover/Sun, 08 Nov 2026 21:28:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-userplace-plugin-takeover/The Userplace WordPress plugin through 1.2.0 fails to perform authorization checks on an exposed AJAX action, allowing unauthenticated attackers to create administrator accounts and modify site settings for full site takeover.The Userplace WordPress plugin through 1.2.0 contains an authorization bypass vulnerability. An AJAX action, intended to be restricted, is accessible to unauthenticated users. The plugin also publicly exposes the nonce meant to protect this action. An attacker can use these flaws to inject administrative credentials or alter critical site configuration options, resulting in a full site takeover.

Impact

Successful exploitation allows unauthenticated attackers to perform administrative actions, including the creation of new administrator accounts and the modification of arbitrary WordPress site options.

Recommendation

  • Audit WordPress installations for the presence of the Userplace plugin version 1.2.0 or earlier.
  • Disable or remove the Userplace plugin until a vendor-supplied patch is installed.
  • Review the WordPress 'wp_users' and 'wp_options' tables for unauthorized administrative accounts or suspicious configuration changes created after November 8, 2026.
]]>criticaladvisoryweb-vulnerabilitywordpresscve-2026-110963authorization-bypass