What is the CVSS score of CVE-2026-13690?

CVE-2026-13690 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of UsersWP are affected by CVE-2026-13690?

The UsersWP WordPress plugin contains a high-severity authentication bypass that allows attackers with valid user credentials to skip two-factor authentication and gain full account access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-13690?

Yes, a public proof-of-concept exploit is available for CVE-2026-13690. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-13690?

Within 24 hours, audit your WordPress infrastructure to identify all installations running UsersWP and determine which versions are in use (vulnerable if version is earlier than 1.2.67). Within 7 days, update all affected instances to UsersWP version 1.2.67 or later; prioritize production environments and any systems handling sensitive data. Within 30 days, verify patch deployment across all systems, review authentication logs for suspicious activity during the exposure period, and validate that two-factor authentication is functioning correctly post-update.

UsersWP CVE-2026-13690

EUVD-2026-50117 HIGH

Improper Authentication (CWE-287)

2026-07-29 WPScan

GHSA-gpf8-hm73-g5qv

WordPress Authentication Bypass Userswp Unknown

7.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network login flow (AV:N) but requires prior knowledge of victim credentials so AC:H; PR:N as the attacker assumes the victim identity, full account takeover gives C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 13:24 vuln.today

CVSS changed

Jul 29, 2026 - 13:22 NVD

7.4 (HIGH)

Patch available

Jul 29, 2026 - 07:01 EUVD

CVE Published

Jul 29, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 06:00 cve.org

HIGH 7.4

DescriptionCVE.org

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

AnalysisAI

Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.

Technical ContextAI

UsersWP is a front-end user-registration, login, and profile plugin for WordPress that offers a two-factor login option. The flaw is a broken/improper authentication issue (CWE-287): the plugin's two-factor login handler does not validate which authentication provider was selected before completing login. Because provider selection is attacker-influenced and unchecked, the second-factor challenge can be improperly satisfied or skipped. The affected component is the plugin code identified by CPE cpe:2.3:a:unknown:userswp, running within the WordPress PHP application stack, so exploitation occurs over normal HTTP(S) against the WordPress login flow rather than at the network or OS layer.

RemediationAI

Vendor-released patch: 1.2.67 - upgrade the UsersWP plugin to version 1.2.67 or later immediately, which is the primary and complete fix; consult the WPScan advisory at https://wpscan.com/vulnerability/144202a9-e86f-4977-a97a-eca673859c81/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13690. If patching cannot be done at once, compensating controls include temporarily disabling the UsersWP two-factor login feature and relying on a separate hardened MFA mechanism or an application firewall, though this removes the plugin's second factor entirely; enforcing strong, unique passwords and forcing password resets for high-value accounts reduces the value of the bypass since the attack requires known credentials; and placing the WordPress login behind an IP allowlist or WAF rules limits who can reach the vulnerable login handler, at the cost of blocking legitimate remote logins.