CVE-2026-110963

Published Nov 8, 2026

Last updated a day ago

CVSS critical 9.8
WordPress
Userplace

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-110963 is a security vulnerability identified in the Userplace WordPress plugin, affecting all versions up to and including 1.2.0. The issue, which was reported by WPScan, stems from the plugin's failure to perform authorization checks on an AJAX action that is accessible to unauthenticated users. Additionally, the plugin publicly exposes the security nonce that is meant to protect this specific action. Because of this flaw, unauthenticated attackers can exploit the exposed nonce to execute the AJAX action, enabling them to create a new administrator account or write arbitrary site options. This can ultimately lead to a complete takeover of the affected WordPress website. At the time of its disclosure, a patched version addressing the vulnerability had not yet been released.

Description
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
Source
contact@wpscan.com
NVD status
Received

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-269

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

21

  1. ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-123551 (CVSS: 10) openidentity... CVE-2026-107331 (CVSS: 9.9) IBM CVE-2026-110963 (CVSS: 9.8) Unknown CVE-2026-114432 (CVSS: 9.8) Unknown CVE-2026-15266 (CVSS: 9.8) ibm ..🧵👇

    @exploitgrid

    9 Nov 2026

    248 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  2. 🆕 New CVE: CVE-2026-110963 (CVSS 9.8, Enclave score 7/10) Unknown Userplace · Privilege escalation Remote, no login needed. The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to… https://t.co/aus98FUxE8

    @EnclaveRadar

    8 Nov 2026

    266 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🔴 Userplace: Userplace <= 1.2.0 - Unauthenticated Privilege Escalation (CVE-2026-110963) No fix listed yet https://t.co/QZt9GqJv7k

    @agentprime_io

    8 Nov 2026

    48 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. 🆕 New CVE Userplace: unauthenticated privilege escalation in AJAX handler (CVE-2026-110963) An unauthenticated attacker can create an admin account or change site options, gaining full control of the site. No patch listed yet https://t.co/cPSwGYKGto

    @cvedotnow

    8 Nov 2026

    17465 Impressions

    31 Retweets

    167 Likes

    63 Bookmarks

    4 Replies

    4 Quotes

Related CVEs

  1. The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.•CVE-2026-114432
  2. The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.•CVE-2026-118423
  3. The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.•CVE-2026-103889
  4. The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.•CVE-2026-15369
  5. Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.•CVE-2026-74943

References

Sources include official advisories and independent security research.