Unrated severityNVD Advisory· Published Nov 8, 2026

CVE-2026-110963

Description

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Userplacellm-create
Range: <=1.2.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000