CVE-2026-110963
Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
| Vendor | unknown |
| Product | userplace |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown userplace
Be the first to know when new unknown vulnerabilities affecting unknown userplace are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Userplace
0 ≤ 1.2.0
References
Credits
Naoki Kawahigashi WPScan