CVE-2026-110963: Userplace WordPress Plugin Lets Unauthenticated Attackers Create Admin Accounts

CVE-2026-110963: Unauthenticated Admin Creation in Userplace

A critical vulnerability has been published in the Userplace WordPress plugin. Tracked as CVE-2026-110963 with a CVSS score of 9.8, the flaw affects versions through 1.2.0.

According to the NVD entry, the plugin does not perform authorization checks on an AJAX action that is reachable by unauthenticated users, and it also publicly exposes the nonce that is meant to protect that action. An attacker can therefore create an administrator account or write arbitrary site options.

Vulnerability Overview

Why This Matters

• No login needed. The AJAX action is available to anonymous visitors.
• The nonce is not a barrier. Because the nonce is publicly exposed, it provides no real protection.
• Full site takeover. A new administrator account lets an attacker install plugins or edit code. Writing arbitrary options can also change site behaviour in ways that lead to compromise.

Remediation

1. Check whether Userplace is installed and which version is running.
2. Update to a fixed release if the vendor has published one. At the time of writing, the NVD entry does not list a patched version.
3. If no fix exists, deactivate and remove the plugin, or block the vulnerable AJAX action at the WAF.
4. Audit administrator accounts for unexpected additions, and review wp_options for unexplained changes, especially users_can_register and default_role.
5. Rotate credentials for any site where an unknown admin account is found.

References

• NVD: CVE-2026-110963