EUVD-2026-83506
GHSA-cg9c-x648-j6c7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running UsersWP with social login
-
DeliveryAssert victim admin email via attacker-controlled provider account
-
ExploitTrigger social-login flow
-
ExecutionPlugin resolves account by unverified email
-
PersistAuthenticated as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the UsersWP social-login feature to be configured and enabled with at least one OAuth/social provider (a non-default add-on capability), and requires that provider to allow the attacker to assert an email address the provider has not confirmed the attacker owns (e.g., a provider that does not verify email or lets the attacker set an arbitrary email). The attacker must also know the target victim's registered email address. These combined preconditions are exactly why the vector carries AC:H despite PR:N/UI:N; sites without social login enabled are not exploitable. |
| Impact | This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut. The vendor CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes an unauthenticated, network-reachable account-takeover flaw with full confidentiality, integrity, and availability impact - attackers can log in as any user, including administrators, which on WordPress means effective site takeover. Two independent escalating signals are present: a publicly available exploit (WPScan) and an available vendor patch (1.5.10). The one factor holding severity below 9+ is AC:H, which is well-justified: the attack requires the social-login feature to be configured, a provider that does not confirm email ownership, and knowledge of the victim's email - so exploitation is conditional rather than universally automatable. No EPSS score or SSVC automatable/exploitation-status data was supplied, and the flaw is NOT on the CISA KEV list, so there is no evidence of active in-the-wild exploitation despite the public POC - do not conflate the two. Net: treat as a fast-track patch for any UsersWP install that has social login enabled. |
| Exploit ScenarioDerived | An attacker registers or controls an account on a social-login provider (or one permitting an arbitrary/unverified email) and asserts a target admin's email address. When the UsersWP social-login flow resolves the incoming provider identity to an existing local account by email without verifying that the provider confirmed ownership, the attacker is logged into the administrator's account. A public exploit for this flow is available via WPScan, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
RemediationAI
Vendor-released patch: 1.5.10 - upgrade the UsersWP plugin to 1.5.10 or later through the WordPress plugin update mechanism (or the vendor's distribution channel), and confirm the update on every site where the plugin is active, since the issue is remotely reachable without authentication and public exploit code exists. If the update cannot be applied immediately, the most effective compensating control is to disable the social-login add-on entirely, which removes the vulnerable email-to-account resolution path; the trade-off is that users lose social sign-in and must authenticate with local WordPress credentials. Where social login must remain enabled, restrict it in the provider configuration or plugin settings to providers known to enforce verified-email semantics (for example requiring an email_verified claim) and to identities the site controls, accepting that this narrows the user base and can still be bypassed by any provider whose email assurance is weak. Additional hardening, each with its own cost, includes temporarily restricting untrusted accounts to low-privilege roles, monitoring authentication and account-profile events for logins whose identity does not match the expected provider, and reviewing administrator accounts for unexpected sessions. Reference the WPScan advisory at https://wpscan.com/vulnerability/f606cf7b-cef8-4b2c-819a-6d3e6adeacee/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-86814, and treat the fix as urgent on any site with site administrators using a social-login provider.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UsersWP extends WordPress with front-end user registration and profile management, and its social-login capability is a non-default add-on that federates authentication through third-party OAuth/social providers. In the vulnerable logic, the plugin takes the email address returned by the provider and uses it as the sole identity key when looking up an existing WordPress account to log the user into, skipping the step of validating that the provider has confirmed ownership of that email (for example an OAuth email_verified claim or equivalent assurance). The root-cause class, CWE-269 (Improper Privilege Management), describes exactly this failure: authentication is granted against an unvalidated identifier, so control of an email string rather than of a mailbox is sufficient to inherit the privileges of the account bound to it - up to administrator. The provided CPE, cpe:2.3:a:unknown:userswp:*:*:*:*:*:*:*:*, carries an 'unknown' vendor token, which is a metadata gap in the upstream feed rather than an indication of a different component; the product is the UsersWP WordPress plugin, tracked by WPScan and mirrored as EUVD-2026-83506 with affected range 0 <1.5.10. Notably the vulnerability sits in the email-to-account resolution path common to OAuth-style federated logins, so the same pattern would apply to any provider integrated into UsersWP's social-login flow that does not enforce verified-email semantics.
Know when Userswp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote (PR:N/AV:N) but conditional on social login being enabled plus a non-verifying provider and known victim email (AC:H); admin takeover yields full C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
Technical POC Analysis
Evidence base: a single WPScan advisory entry.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Sites running the UsersWP WordPress plugin below version 1.5.10 with social login enabled are exposed to full account takeover, including administrator accounts, because the plugin trusts an unverified email address asserted by a social login provider. An unauthenticated remote attacker who knows a target's registered email and can register with a provider that does not verify addresses can log in as that user, potentially handing over complete control of the website and its hosted content. Leadership should treat this as a high-priority exposure for any externally facing WordPress estate using this plugin, given that compromise of an administrator account can lead to data theft, defacement, malware distribution, and lateral movement into connected business systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could all
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make su
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attac
Missing authorization checks in the UsersWP WordPress plugin (all versions through 1.2.74) allow an authenticated low-pr
The UsersWP - Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for
A vulnerability in Stiofan UsersWP userswp.2.3.9. Rated medium severity (CVSS 5.8), this vulnerability is remotely explo
Exploit-DB