UsersWP CVE-2026-103086

Requires an authenticated session at a low privilege level (PR:L) - in practice a registered/subscriber account, which UsersWP-enabled sites commonly allow via open self-registration, lowering the effective barrier. Exploitation is remote over the network with low complexity and no user interaction, affecting UsersWP versions from an unspecified start through 1.2.74. Limiting factors: the attacker must first obtain a valid account (sites that disable public registration raise this bar significantly), impact is restricted to data integrity (no data disclosure or denial of service via this flaw), and the exact affected feature/action is not specified in the available data.

This is a moderate-risk broken access control (Missing Authorization, CWE-862) flaw in the UsersWP WordPress plugin, scored CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable, low-complexity attacks requiring only low-level authentication (PR:L) and no user interaction - meaning any authenticated low-privilege user (e.g., subscriber/registered member, which this plugin exists to create in bulk) can trigger it. The impact is integrity-only (C:N/I:H/A:N): an attacker can modify data they should not be authorized to touch, but cannot read confidential data or cause outages through this issue. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic priority is tempered by the PR:L requirement and integrity-only scope, but elevated by the plugin's purpose: sites running UsersWP routinely allow open user registration, so the 'low privilege' barrier is often trivially met. Note the description is generic ('Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected - the precise exploitable function should be verified against the Patchstack advisory.

An attacker registers a standard low-privilege account on a WordPress site running UsersWP (≤1.2.74), which the plugin itself makes easy by design. Using that authenticated session, the attacker invokes a plugin action that lacks a proper authorization (capability/ownership) check, allowing them to modify data or settings beyond their intended permission level. No public exploit code was provided, and the attack requires authentication but no user interaction or elevated complexity.