EUVD-2026-68042
GHSA-p38m-pp69-pr2w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Uix UserCenter ≤1.0.3
-
DeliveryForge token with hardcoded signing key
-
ExploitSend unauthenticated profile-update request for admin ID
-
ExecutionOverwrite admin email and password
-
PersistLog in as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is that the target WordPress site has the Uix UserCenter plugin (version ≤1.0.3) installed and active, exposing its unauthenticated profile-update action; the plugin's hardcoded signing key is present in every install by default, so no special configuration, authentication, user interaction, or non-default setting is required (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is deployment footprint rather than exploit difficulty: exploitation only affects sites actually running this specific plugin, and an attacker must reach the site's HTTP(S) endpoint. Exploitation is not gated by platform, WordPress version, or admin interaction. |
| Impact | The signals are mostly aligned toward high severity but with an important nuance on real-world likelihood. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) accurately reflects a trivially reachable, unauthenticated, no-interaction path to full account/admin takeover, and publicly available exploit code (WPScan) lowers the skill barrier. Counterbalancing this, EPSS is only 0.14% (3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - consistent with a niche plugin that few internet-wide scanners currently target. In practical terms this is a genuine 'patch-now if installed' issue for the small population running the plugin, rather than an internet-scale event; the low EPSS most likely reflects small install base and immaturity of mass-scanning, not low technical exploitability. No conflicting data was observed: the network vector and unauthenticated access in the CVSS vector match the description's 'unauthenticated profile-update action.' |
| Exploit ScenarioDerived | Using the publicly available WPScan exploit details, an unauthenticated attacker reconstructs the token from the plugin's hardcoded signing key, forges a token naming the administrator's user ID, and sends a single crafted profile-update request over the network (AV:N/AC:L, no login or user interaction). The request overwrites the administrator's email and password, after which the attacker completes a password reset or logs in directly to gain full control of the WordPress site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
RemediationAI
No vendor-released patch identified at time of analysis - the available data lists all versions through 1.0.3 as vulnerable with no fixed version specified, so monitor the vendor and the WPScan advisory (https://wpscan.com/vulnerability/e551128c-c9b1-4e6a-a2aa-92830b7a4887/) for a release above 1.0.3 and upgrade as soon as one is published. Until a fix is available, the most reliable compensating control is to deactivate and remove the Uix UserCenter plugin, which eliminates the vulnerable profile-update endpoint but disables all user-center front-end functionality; if the plugin cannot be removed, use a WAF or web-server rule to block or restrict unauthenticated requests to the plugin's profile-update action/AJAX endpoint, accepting that this may break legitimate self-service profile updates. As a post-exposure precaution, force a password reset for all administrator accounts and audit recent changes to admin email addresses, since the flaw permits silent credential overwrite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Uix UserCenter is a front-end user-management plugin for WordPress that exposes account self-service actions (profile/email/password updates) to site visitors. Two compounding defects create the flaw: a missing object-ownership check on the profile-update action (a broken-access-control / IDOR pattern), and a hardcoded, install-invariant HMAC/signing key used to mint the authorization token. CWE-269 (Improper Privilege Management) is the assigned root-cause class - the trust boundary between an anonymous requester and a privileged account is not enforced. Because the signing secret is shipped in the plugin source, any attacker can reproduce the token-generation logic offline and sign a token that the plugin accepts as authentic for an arbitrary user ID. The affected component is identified by CPE cpe:2.3:a:unknown:uix_usercenter (vendor left as 'unknown' in NVD data).
Know when Uix Usercenter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network request with a hardcoded universal key and no ownership check yields no-privilege, no-interaction admin takeover with full C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.
Technical POC Analysis
Advisory classifies this as CWE-269 Improper Privilege Management.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB