CVE-2026-119980
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 31 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because get_dummy_user_passowrd() derives the shared password f…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/AyeCode/userswp/archive/refs/heads/master.zip
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-forms.php#L5244
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-templates.php#L850
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-tools.php#L606
- https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-userswp.php#L565
- https://plugins.trac.wordpress.org/changeset/3774438/userswp/trunk/includes/class-tools.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7c458034-9c44-4b46-8845-4c05bea043a0?source=cve
Original description
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
Last activity 31 Oct 2026. Patch Forecast updates every hour.