CVE-2026-110963: critical vulnerability in Userplace
Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.3%
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Userplacepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.