UsersWP CVE-2026-13690

Exploitation requires that the attacker already possesses the victim's valid WordPress credentials (username and password) and that the target site runs UsersWP before 1.2.67 with the two-factor login feature enabled for that account. The specific weakness is that the two-factor login handler does not validate the selected authentication provider, so the attacker manipulates the provider selection during the 2FA step. Limiting factors: the attack is useless without prior credential compromise (its entire purpose is defeating the 2FA safety net), it only matters where UsersWP 2FA is actually configured, and CVSS assigns AC:H reflecting this credential prerequisite; no victim user interaction is required.

The CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N: network-reachable, no user interaction, high impact to confidentiality and integrity (account takeover), high attack complexity, and no availability impact. The critical caveat is the PR:N-versus-description tension: CVSS marks the vector as requiring no privileges, yet the description explicitly states the attacker must already know the target user's credentials - this precondition is what justifies AC:H and materially limits real-world risk, since 2FA here is a defense-in-depth layer rather than the sole barrier. Publicly available exploit code raises weaponization potential, but this is not listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation is not evidenced - suggesting targeted use against already-compromised credentials rather than mass exploitation. Net assessment: a real, patch-worthy account-takeover risk for sites relying on UsersWP 2FA to protect accounts with phished, reused, or leaked passwords, but gated behind prior credential compromise rather than a fully unauthenticated remote takeover.

An attacker who has obtained a WordPress user's password through phishing, credential stuffing, or a prior breach submits those credentials to a UsersWP-protected site and, because the two-factor login handler does not validate the selected authentication provider, manipulates the provider selection to bypass the 2FA challenge and gains full access to that account. Publicly available exploit code lowers the effort required, though the high attack complexity reflects the need for valid credentials up front.