External risk intelligence

Userplace WordPress Plugin Administrator Account Creation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-110963

The vulnerability affects a WordPress plugin, a type of software designed to be publicly accessible via the internet. Because the flaw exists in an AJAX action available to unauthenticated users, the attack surface is exposed by design in any standard public-facing WordPress installation.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Userplace WordPress plugin, which allows unauthenticated users to potentially create administrator accounts or alter site options. This could lead to a complete takeover of a website.

Flaw allows anyone to gain admin access.
Unchecked access can lead to site compromise.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by accessing a WordPress site that uses a vulnerable version of the Userplace plugin. Since the flaw involves an AJAX action that doesn't require authentication, an attacker could directly interact with this feature. This interaction allows them to bypass security checks and exploit the vulnerability to create a new administrator account or alter site settings, ultimately giving them complete control over the website.

Publicly accessible website needed.
Unauthenticated AJAX action can be called.
Full site takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain administrative control over a WordPress site. By exploiting a missing authorization check in an AJAX action, an attacker could create a new administrator account or modify critical site settings, leading to a complete site takeover. This is possible because the protection mechanism for this action is publicly exposed.

An administrator account or site options.
Unauthenticated users triggering an AJAX action.
Full site takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Userplace WordPress plugin allows for full site takeover by unauthenticated attackers. Identifying all instances of this plugin, confirming their reachability and business criticality, and then coordinating with the website owner or platform team is the crucial first step. Subsequent remediation planning should be risk-based, potentially involving vendor coordination for a fix or temporary mitigation strategies.

Website owners and platform teams should own.
Verify plugin presence and public exposure first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Userplace WordPress plugin?

Userplace is a plugin designed to extend the functionality of WordPress websites. WordPress plugins act as add-on modules that handle specific tasks, such as managing users or site settings. In this case, the plugin is intended to provide specific user-related services, but it inadvertently introduced a severe security flaw that impacts how the platform verifies user identity.

What does CWE-269 mean for CVE-2026-110963?

This vulnerability is classified as CWE-269, which refers to Improper Privilege Management. In simple terms, the software fails to correctly check if a user has the right permissions to perform a sensitive action. Because of this, the plugin treats unauthenticated visitors as if they have the same elevated powers as a site administrator, allowing them to change critical settings or create new accounts.

How can an attacker trigger this flaw?

An attacker can exploit this by directly calling a specific AJAX action built into the plugin that lacks authorization checks. Since the security token meant to protect this action is publicly exposed, no special login or previous access is needed. Simply visiting the site and sending a request to the right location is enough to bypass defenses; there is no requirement for the attacker to already have a registered account on the site.

Is my website at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is considered very likely to be a concern because the plugin is designed to be publicly reachable. Because the flaw lives in an AJAX action available to anyone on the internet, any standard public-facing WordPress installation using the affected version is effectively exposed by design and should be treated as a priority for assessment.

What should I do if I use the Userplace plugin?

Your first step is to confirm whether you have the affected version of the plugin installed on your WordPress site. Once identified, evaluate the business importance of the site to prioritize your response. Because this flaw allows for a complete takeover of your website, you should look for official updates from the vendor or consider temporarily disabling the plugin until a secure version is available to prevent unauthorized access.

References

wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.