CVE-2026-110963

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Unknown	Userplace	<= 1.2.0

References

https://wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/

Timeline

Published: Nov 8, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1109646.5The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleti CVE-2026-110976.5Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin da CVE-2026-1109702.3Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, ob CVE-2026-1109717.7Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue CVE-2026-1109728.6Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass CVE-2026-1109746.3The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() CVE-2026-1109757.4A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configurat CVE-2026-1109764.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user CVE-2026-110985.3Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the CVE-2026-1109817.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a CVE-2026-1109824.9The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title CVE-2026-1109834.3The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management