Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover

Executive Summary

CVE-2026-16259 affects the Uix UserCenter WordPress plugin (versions through 1.0.3) and carries a maximum-severity CVSS score of 9.8. The plugin exposes an unauthenticated profile-update action that never verifies the account being modified actually belongs to the person making the request. Instead, the action is "secured" by a token whose signing key is hardcoded and identical across every installation of the plugin — meaning anyone who has the key (trivially recoverable from the plugin's own source) can forge a valid token for any account on any site running it.

CVSS Score: 9.8 (Critical)

There is no patched version available as of this advisory. Sites running Uix UserCenter should treat every user account, including administrator accounts, as potentially takeover-able until the plugin is removed or a fix ships.

Vulnerability Overview

Affected Versions

Technical Details

Uix UserCenter ships a profile-update endpoint intended to let logged-in users edit their own account. Two design flaws combine into full account takeover:

1. Missing ownership check. The endpoint accepts a target account identifier in the request but never confirms that identifier matches the requester's own session or identity.
2. Hardcoded signing key. Instead of relying on WordPress's own authentication/nonce system, the action is authorized by a bearer-style token signed with a key that is baked into the plugin's code and therefore identical on every single install — not per-site, not per-secret, not rotated.

Because the signing key never changes between installations, an attacker only needs to obtain the plugin's public distribution (trivial, since it's a WordPress.org-style plugin) to extract the key once and reuse it forever, against any site running the plugin. From there, forging a valid token for an arbitrary user ID — including a site's administrator account — is enough to modify that account's profile fields, which in practice extends to takeover-relevant data such as the account email address, from which a password reset can be triggered.

Attack Vector

1. Attacker downloads/extracts the Uix UserCenter plugin source
2. Attacker recovers the hardcoded signing key (same across all installs)
3. Attacker forges a signed profile-update token for an arbitrary target user ID
4. Attacker sends the unauthenticated profile-update request to the target site
5. Target account's profile (e.g. registered email) is modified without owner consent
6. Attacker triggers a password reset against the now-attacker-controlled email
7. Attacker gains full control of the compromised account, including admin accounts

Impact of Successful Exploitation

Immediate Remediation

Step 1: Check Exposure

# From the WordPress admin dashboard or via WP-CLI:
wp plugin list --status=active | grep -i usercenter

Step 2: Remove or Deactivate

Because no fixed version currently exists, the only reliable mitigation is:

1. Deactivate and remove the Uix UserCenter plugin immediately.
2. Force a password reset for all user accounts, prioritizing administrator and editor roles.
3. Review recent profile-update activity in your hosting or application logs for signs of prior exploitation.

If the Plugin Cannot Be Removed Immediately

1. Block requests to the plugin's profile-update endpoint at the web server or WAF level.
2. Restrict WordPress admin login to known IP ranges as a compensating control.
3. Enable multi-factor authentication for all privileged accounts so a hijacked email alone cannot complete account takeover.

Detection Indicators

Post-Remediation Steps

1. Confirm removal of the Uix UserCenter plugin across all affected sites.
2. Audit all user accounts for unauthorized email or profile changes made before removal.
3. Rotate credentials for any account whose email address may have been altered.
4. Monitor vendor channels for a fixed release before reinstalling the plugin.
5. Track NVD/WPScan for an updated advisory with a patched version number.

References

• NVD — CVE-2026-16259
• WPScan Vulnerability Database — Uix UserCenter ≤ 1.0.3 Unauthenticated Account Takeover