USERPLACE-MEMBER-SUBSCRIPTION-RESTRICTION-PAYMENTS · CVE-2026-110963 · Package
NO FIX YET · SEE WHAT TO DO
The Userplace WordPress plugin through version 1.2.0 has an AJAX action open to unauthenticated users with no authorization check, and it exposes the nonce that protects it. An anonymous visitor can create an administrator account or write arbitrary site options, which gives full control of the site.
first public Nov 8, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the Userplace plugin at version 1.2.0 or earlier is exposed, because the vulnerable AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. The sources do not state a fixed version or a workaround.
Not affected if plugin-not-installed
Who cares self-hosted, userplace, wordpress
1.2.0 is the latest release and WordPress.org has closed the plugin (as of Oct 23, 2026, pending review)The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.