{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119980", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-30T17:53:54.941Z", "datePublished": "2026-10-31T06:44:19.791Z", "dateUpdated": "2026-10-31T06:44:19.791Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-10-31T06:44:19.791Z"}, "affected": [{"vendor": "stiofansisland", "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.78", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response \u2014 reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page."}], "title": "UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c458034-9c44-4b46-8845-4c05bea043a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-tools.php#L606"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-templates.php#L850"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-forms.php#L5244"}, {"url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-userswp.php#L565"}, {"url": "https://github.com/AyeCode/userswp/archive/refs/heads/master.zip"}, {"url": "https://plugins.trac.wordpress.org/changeset/3774438/userswp/trunk/includes/class-tools.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kuba"}], "timeline": [{"time": "2026-10-29T17:10:44.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-10-30T17:58:07.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "vendor": "stiofansisland", "versions": [{"lessThanOrEqual": "1.2.78", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response \u2014 reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page."}], "id": "CVE-2026-119980", "lastModified": "2026-10-31T07:16:36.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-10-31T07:16:36.920", "references": [{"source": "security@wordfence.com", "url": "https://github.com/AyeCode/userswp/archive/refs/heads/master.zip"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-forms.php#L5244"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-templates.php#L850"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-tools.php#L606"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-userswp.php#L565"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3774438/userswp/trunk/includes/class-tools.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c458034-9c44-4b46-8845-4c05bea043a0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"created": "2026-10-31T08:30:13.939800+00:00", "updated": "2026-10-31T08:30:13.939808+00:00", "vendors": []}