UsersWP CVE-2026-119980

Exploitation requires that an administrator has previously created the 25 built-in dummy user accounts via the UsersWP plugin's Tools page; on sites that never used this feature there are no dummy accounts to authenticate as and the attack yields nothing. Given that precondition, no authentication and no user interaction are needed: the uwp_register_hash field is exposed unauthenticated through both the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler, and the latter remains reachable even when user registration is disabled. The principal limiting factors are therefore the dummy-user precondition and the actual role assigned to those dummy accounts - meaningful privilege escalation only occurs if a dummy account was given an elevated role; otherwise impact is limited to access at the dummy account's privilege level.

This is a genuine but conditional, mid-severity issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) reflects unauthenticated network exploitation at low complexity against default configurations - a single unauthenticated HTTP request to /register/ or the wp_ajax_nopriv_uwp_ajax_register_form handler returns the uwp_register_hash field whose full 25-character value is the same SHA256 hash the plugin truncates to derive the shared dummy-account password. That is a clean, deterministic bug with no user interaction. The vuln.today decision label is this_month, not act_now/emergency, which is consistent with the real-world picture: there is no CISA KEV listing (not actively exploited per available data) and no EPSS score was supplied, so probability of near-term mass exploitation cannot be quantified from the input. The low/low confidentiality and integrity impact caps the raw severity, and real risk is heavily gated by one precondition the CVSS vector does not capture - an administrator must have previously created the 25 built-in dummy users via the plugin's Tools page; sites that never used that feature are not exploitable. Escalation to a serious compromise further depends on whether any dummy account was assigned an elevated role, which is not confirmed in the available data. Net: a real priority to patch this month, but its severity in a given environment swings on configuration that the single 6.5 number does not express.

An unauthenticated attacker requests the plugin's public /register/ page (or calls the wp_ajax_nopriv_uwp_ajax_register_form AJAX endpoint, which works even when registration is disabled) and reads the hidden uwp_register_hash value from the response. Because that value is the full SHA256 hash from which the shared dummy-user password is a substring, the attacker derives the password offline and logs in through wp-login.php as a built-in dummy account such as antawn, chynna, or kiki. No public working exploit is identified in the input, though Wordfence has published an advisory and the vulnerable source lines are visible in the plugin's trac repository.